mediasoup: mediasoup-worker crash: free(): invalid pointer

Bug Report

It’s consistently happening in the demo server which is running very latest 3.11.19 version. No idea how to reproduce.

2023-03-30T10:06:18.320Z mediasoup:ERROR:Worker (stderr) free(): invalid pointer
2023-03-30T10:06:18.323Z mediasoup:ERROR:Worker worker process died unexpectedly [pid:3465, code:null, signal:SIGABRT]

Your environment

Operating system: Linux Debian
gcc/clang version: 6.3.0
mediasoup version: 3.11.19

About this issue

Original URL
State: closed
Created a year ago
Comments: 20 (19 by maintainers)

Commits related to this issue

SeqManager: fix crash and add fuzzer Fixes #1042 — committed to versatica/mediasoup by jmillan a year ago
SeqManager: fix crash and add fuzzer (#1045) * SeqManager: fix crash and add fuzzer Fixes #1042 — committed to versatica/mediasoup by jmillan a year ago

Most upvoted comments

Suppose that (this->maxInput + MaxValue / 3) is more than MaxValue. Then treshhold will be less than this->maxInput and it2 may turn out to be in front of it1.

snnz on Mar 30, 2023

(gdb)
(gdb) bt full
#0  0x00007f6d294eace1 in raise () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#1  0x00007f6d294d4537 in abort () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#2  0x00007f6d2952d768 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#3  0x00007f6d29534a5a in ?? () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#4  0x00007f6d29535c14 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#5  0x0000559b97f74942 in RTC::SeqManager<unsigned short, (unsigned char)0>::ClearDropped() ()
No symbol table info available.
#6  0x0000559b97f74a40 in RTC::SeqManager<unsigned short, (unsigned char)0>::Input(unsigned short, unsigned short&) ()
No symbol table info available.
#7  0x0000559b97f8752f in RTC::SvcConsumer::SendRtpPacket(RTC::RtpPacket*, std::shared_ptr<RTC::RtpPacket>&) ()
No symbol table info available.
#8  0x0000559b97f48df4 in RTC::Router::OnTransportProducerRtpPacketReceived(RTC::Transport*, RTC::Producer*, RTC::RtpPacket*) ()
No symbol table info available.
#9  0x0000559b97f371d3 in RTC::Producer::ReceiveRtpPacket(RTC::RtpPacket*) ()
No symbol table info available.
#10 0x0000559b97f89d3f in RTC::Transport::ReceiveRtpPacket(RTC::RtpPacket*) ()
No symbol table info available.
#11 0x0000559b97fb8d2b in RTC::WebRtcTransport::OnRtpDataReceived(RTC::TransportTuple*, unsigned char const*, unsigned long) ()
No symbol table info available.
#12 0x0000559b97faafa8 in RTC::WebRtcServer::OnUdpSocketPacketReceived(RTC::UdpSocket*, unsigned char const*, unsigned long, sockaddr const*) ()
No symbol table info available.
#13 0x0000559b982bb0b1 in uv.udp_recvmmsg ()
No symbol table info available.
#14 0x0000559b982bbd3b in uv.udp_io ()
No symbol table info available.
#15 0x0000559b982bf0bd in uv.io_poll ()
No symbol table info available.
#16 0x0000559b982b291f in uv_run ()
No symbol table info available.
#17 0x0000559b97e92a19 in DepLibUV::RunLoop() ()
No symbol table info available.
#18 0x0000559b97e9ec3f in Worker::Worker(Channel::ChannelSocket*, PayloadChannel::PayloadChannelSocket*) ()
No symbol table info available.
#19 0x0000559b97e9147d in mediasoup_worker_run ()
No symbol table info available.
#20 0x0000559b97e90054 in main ()
No symbol table info available.

@jmillan:

RTC::SeqManager<unsigned short, (unsigned char)0>::ClearDropped() () is producing the crash.

ibc on Mar 30, 2023