linux-core分析 : sip变量赋值-指针悬挂

原创已于 2025-04-07 14:28:36 修改 · 302 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#linux

于 2025-04-07 14:21:54 首次发布

coredump 专栏收录该内容

4 篇文章

订阅专栏

文章目录

core调用栈

Thread 1 (Thread 0x5c8c9460 (LWP 3562)):
#0  0x4182e8e8 in raise () from /lib/libc.so.6
#1  0x4183271c in abort () from /lib/libc.so.6
#2  0x4186573c in __libc_message () from /lib/libc.so.6
#3  0x4186ff04 in malloc_printerr () from /lib/libc.so.6
#4  0x0011f7d4 in sdp_connection_free ()
#5  0x0010503c in osip_list_special_free ()
#6  0x0011fc6c in sdp_media_free ()
#7  0x0010503c in osip_list_special_free ()
#8  0x00124d74 in sdp_message_free ()
#9  0x000e6634 in SipMessageTranslate (sip=0xaca7100, OutBoundAddress=0x5c8c8a3c "", OutBoundPort=0x5c8c8bb0, bEnableRouteNewMsg=1,
    pLocalSipUsedEthIp=0x5c8c8abc "", ulLocalSipUsedEthPort=0x5c8c8bac, workerid=1) at SipRouteManager.cpp:4973
#10 0x000d815c in SynwaySipEventCallback (pEvent=0x208d178, flag=5) at SipRouteManager.cpp:1143
#11 0x402f8838 in ProcessSipEventRoute (workerid=1) at SipLogical.cpp:2691
#12 0x402dad6c in SipEventHandleThreadFR (lpParam=0x41403a1c <thread_param+4>) at SipInterface.cpp:1619
#13 0x4003ee64 in start_thread () from /lib/libpthread.so.0
#14 0x418cd588 in ?? () from /lib/libc.so.6

core分析

sdp_message_free内存释放存在问题，分析代码中sdp消息修改的内容

sdp_connection_t* audio_con = static_cast<sdp_connection_t*>(osip_list_get(&med->c_connections, 0));
	if (audio_con != NULL)
	{
		if (audio_con->c_addr != NULL)
        {
            osip_free(audio_con->c_addr);
        }
		audio_con->c_addr = c_addr;
	}

原因：
直接让 audio_con->c_addr 指向 c_addr 所指向的内存，那么多个 sdp_connection_t 结构体可能会共享同一块内存。一旦原始的 c_addr 指向的内存被修改或者释放，所有指向该内存的 audio_con->c_addr 都会受到影响，导致指针悬挂

修改

使用 osip_strdup 进行复制，每个 sdp_connection_t 结构体中的 c_addr 都有自己独立的内存副本。这样，每个结构体中的地址信息可以独立修改和管理，不会相互影响

char* osip_strdup(const char *ch)
{
	char *copy = NULL;
	size_t length;
	
	if (ch == NULL)
		return NULL;
	
	length = strlen (ch);
	
	copy = (char*)osip_malloc(length + 1);
	
	osip_strncpy(copy, ch, length);
	
	return copy;
}

if (audio_con != NULL)
	{
		if (audio_con->c_addr != NULL)
        {
            osip_free(audio_con->c_addr);
			audio_con->c_addr = NULL;
        }
		char* new_addr = osip_strdup(c_addr);
        if (new_addr != NULL)
        {
            audio_con->c_addr = new_addr;
        }
	}