Project

General

Profile

Actions

Bug #3635

closed

heap-use-after-free msc_mgcp.c:163 in _handle_error

Added by neels over 5 years ago. Updated over 5 years ago.

Status:
Resolved
Priority:
High
Assignee:
Category:
-
Target version:
-
Start date:
10/07/2018
Due date:
% Done:

100%

Resolution:
Spec Reference:

Description

was trying to call between 2G and 3G, there was some error, and then osmo-msc crashed.

due to my ongoing tests, the MGW for MSC crashes, then the MSC also goes down because of that.
This here is not about the MGW crash, it's about the MSC that should continue to be stable despite MGW problems.

20181007140227444 DMGCP DEBUG MGW(MGW_8)[0x612000036520]{ST_HALT}: Timeout of T1 (fsm.c:189)
20181007140227444 DLMGCP INFO Canceled transaction 5 (mgcp_client.c:979)
=================================================================
==8329==ERROR: AddressSanitizer: heap-use-after-free on address 0x61a000034910 at pc 0x555555713b4d bp 0x7fffffffdb30 sp 0x7fffffffdb28
READ of size 4 at 0x61a000034910 thread T0
    #0 0x555555713b4c in _handle_error ../../../../src/osmo-msc/src/libmsc/msc_mgcp.c:163
    #1 0x55555571e4d2 in fsm_timeout_cb ../../../../src/osmo-msc/src/libmsc/msc_mgcp.c:239
    #2 0x7ffff6aacf7e in fsm_tmr_cb ../../../src/libosmocore/src/fsm.c:192
    #3 0x7ffff6a8db9b in osmo_timers_update ../../../src/libosmocore/src/timer.c:257
    #4 0x7ffff6a912e1 in osmo_select_main ../../../src/libosmocore/src/select.c:254
    #5 0x5555556a4b3a in main ../../../../src/osmo-msc/src/osmo-msc/msc_main.c:702
    #6 0x7ffff4785b16 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x22b16)
    #7 0x5555556a5b39 in _start (/usr/local/bin/osmo-msc+0x151b39)

0x61a000034910 is located 144 bytes inside of 1208-byte region [0x61a000034880,0x61a000034d38)
freed by thread T0 here:
    #0 0x7ffff72c6b50 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe8b50)
    #1 0x7ffff707fa92 in _talloc_free (/usr/lib/x86_64-linux-gnu/libtalloc.so.2+0x4a92)

previously allocated by thread T0 here:
    #0 0x7ffff72c6ed0 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe8ed0)
    #1 0x7ffff7081ae0 in _talloc_zero (/usr/lib/x86_64-linux-gnu/libtalloc.so.2+0x6ae0)

SUMMARY: AddressSanitizer: heap-use-after-free ../../../../src/osmo-msc/src/libmsc/msc_mgcp.c:163 in _handle_error


Files

os3635.pcapng os3635.pcapng 2.78 MB arbitrary context, crash is at the end neels, 10/07/2018 01:06 PM
Actions

Also available in: Atom PDF

Add picture from clipboard (Maximum size: 48.8 MB)