[Freeswitch-dev] mod-java - playAndGetDigits() exception

Damjan Jovanovic damjan at ecntelecoms.com
Wed Apr 9 15:40:37 EDT 2008


X-ECN Telecoms-MailScanner-Information: Contact ECN Telecoms
X-ECN Telecoms-MailScanner: Found to be clean
X-ECN Telecoms-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
	score=-103.879, required 6, autolearn=not spam, ALL_TRUSTED -1.80,
	AWL 0.52, BAYES_00 -2.60, USER_IN_WHITELIST -100.00)
X-ECN Telecoms-MailScanner-From: damjan at ecntelecoms.com
X-Spam-Status: No

After digging through my code for 2 hours, sticking debugging statements
all over the show, and copying buffers before use (thinking they are
maybe read-only after coming from the JVM), reading cryptic traces and
useless cores, and finally stumbling across freeswitch.log, I saw that
switch_cpp.cpp ingeniously assumes the buffer is at least 128 bytes long
and since it is obviously smaller, filling it corrupts memory (which is
also a SECURITY RISK).

Make sure your dtmf_buf is at least 128 bytes long, possibly +1 for the
NULL terminator, and possibly more just in case some other undocumented
code makes another brilliant assumption like that.

By the way, I'm in the process of rewriting mod_java, and the new one
will most likely completely avoid swig and (by the looks of it)
switch_cpp.

Enjoy
Damjan

On Wed, 2008-04-09 at 08:03 -0700, jonathan augenstine wrote:
> Is there any feedback on this issue?
> 
> On Mon, Apr 7, 2008 at 9:27 AM, jonathan augenstine
> <jaugenstine at gmail.com> wrote:
>             public void run(String sessionUuid, String args)
>             {
>                 freeswitch.console_log("notice", "INBOUND UUID: " +
>         sessionUuid + " ARGS: " + args + "\n");
>                 JavaSession session = null;
>                 
>                 try
>                 {
>                     session = new JavaSession(sessionUuid);
>                     
>                     if(session == null) {
>                         freeswitch.console_log("notice", "ERROR:
>         session is NULL\n");
>                         return;
>                     } else {
>                         freeswitch.console_log("notice", "SUCCESS
>         creating session\n");
>                     }
>                     
>                     session.setAutoHangup(false);
>                    
>                     byte[] dtmf_buf = new byte[20];
>                     byte[] term_buf = new byte[4];
>                     
>                     String raw_dnis =
>         session.getVariable("originate_caller_id_number");
>                     String raw_ani =
>         session.getVariable("caller_id_number");
>                     
>                     String leading = raw_ani.substring(0, 1);
>                     String ani = null;
>                     if(leading.startsWith("+")) {
>                         // skip first digit
>                         ani = raw_ani.substring(1);
>                     } else {
>                         // capture all digits
>                         ani = raw_ani.substring(0);
>                     }
>                     
>                     freeswitch.console_log("notice", "INBOUND ANI: 00"
>         + ani + " DNIS: " + raw_dnis + "\n");
>                    
>                     String destNumber = authorize("001" + ani);
>                    
>                     if(destNumber == null) {
>                         // handle as non-widget call
>                         // collect DTMF of dial out phone number
>                         
>                         freeswitch.console_log("notice",
>         "playAndGetDigits called next!!!\n");
>                         
>                         int done = 0;
>                         do {
>                             dtmf_buf = new byte[20];
>                             term_buf = new byte[4];
>         
>                             // dial number collection
>                             session.playAndGetDigits(10, 20, 3, 30000,
>         "#", "/usr/local/freeswitch/sounds/DialNumber.wav",
>         "/usr/local/freeswitch/sounds/NotAsDialed.wav", dtmf_buf, "");
>         
>         
>         
>         On Sun, Apr 6, 2008 at 11:05 PM, Damjan Jovanovic
>         <damjan at ecntelecoms.com> wrote:
>                 X-ECN Telecoms-MailScanner-Information: Contact ECN
>                 Telecoms
>                 X-ECN Telecoms-MailScanner: Found to be clean
>                 X-ECN Telecoms-MailScanner-SpamCheck: not spam,
>                 SpamAssassin (not cached,
>                        score=-104.399, required 6, autolearn=not spam,
>                 ALL_TRUSTED -1.80,
>                        BAYES_00 -2.60, USER_IN_WHITELIST -100.00)
>                 X-ECN Telecoms-MailScanner-From:
>                 damjan at ecntelecoms.com
>                 X-Spam-Status: No
>                 
>                 Calling the playAndGetDigits() function is a bit
>                 obscure in Java, some
>                 args are input/output parameters. Post the code so I
>                 can see how you're
>                 trying to call it.
>                 
>                 Bye
>                 Damjan
>                 
>                 
>                 
>                 On Sun, 2008-04-06 at 22:46 -0700, jonathan augenstine
>                 wrote:
>                 > Here is the bt full backtrace:
>                 >
>                 > (gdb) bt full
>                 > #0  0x0088b402 in __kernel_vsyscall ()
>                 > No symbol table info available.
>                 > #1  0x00361fa0 in raise () from /lib/libc.so.6
>                 > No symbol table info available.
>                 > #2  0x003638b1 in abort () from /lib/libc.so.6
>                 > No symbol table info available.
>                 > #3  0x00398ebb in __libc_message ()
>                 from /lib/libc.so.6
>                 > No symbol table info available.
>                 > #4  0x003a0f41 in _int_free () from /lib/libc.so.6
>                 > No symbol table info available.
>                 > #5  0x003a4580 in free () from /lib/libc.so.6
>                 > No symbol table info available.
>                 > #6  0x011e747c in os::free ()
>                 >
>                 from /usr/java/jdk1.5.0_12/jre/lib/i386/client/libjvm.so
>                 > No symbol table info available.
>                 > #7  0x010fd233 in jni_ReleaseByteArrayElements ()
>                 >
>                 from /usr/java/jdk1.5.0_12/jre/lib/i386/client/libjvm.so
>                 > No symbol table info available.
>                 > #8  0x009c1f5e in
>                 >
>                 Java_org_freeswitch_swig_freeswitchJNI_CoreSession_1playAndGetDigits
>                 > (jenv=0xad91cf90, jcls=0x6ce587c,
>                 >     jarg1=2949394128, jarg1_=0x6ce58a8, jarg2=10,
>                 jarg3=20, jarg4=3,
>                 > jarg5=30000, jarg6=0x6ce5894, jarg7=0x6ce5890,
>                 >     jarg8=0x6ce588c, jarg9=0x6ce5888,
>                 jarg10=0x6ce5884)
>                 > at /usr/java/jdk1.5.0_12/include/jni.h:1665
>                 >     jresult = <value optimized out>
>                 >     arg6 = 0xb291c7a0 "#"
>                 >     arg7 = 0xb292d770
>                 "/usr/local/freeswitch/sounds/DialNumber.wav"
>                 >     arg8 = 0xb292dab8
>                 "/usr/local/freeswitch/sounds/NotAsDialed.wav"
>                 >     arg10 = 0xb2915838 ""
>                 >     result = 1
>                 > #9  0x02d562dd in ?? ()
>                 > No symbol table info available.
>                 > #10 0xad91cf90 in ?? ()
>                 > No symbol table info available.
>                 > #11 0x06ce587c in ?? ()
>                 > No symbol table info available.
>                 > #12 0xafcc2ed0 in ?? ()
>                 > No symbol table info available.
>                 > #13 0x00000000 in ?? ()
>                 > No symbol table info available.
>                 >
>                 >
>                 > On Fri, Apr 4, 2008 at 9:59 PM, Michael Jerris
>                 <mike at jerris.com>
>                 > wrote:
>                 >         Can you disable crash protection and get a
>                 real backtrace of
>                 >         this?
>                 >
>                 >         Mike
>                 >
>                 >
>                 >         On Apr 5, 2008, at 12:19 AM, jonathan
>                 augenstine wrote:
>                 >
>                 >         > Damjan,
>                 >         >
>                 >         > OK, the mod_java initialization problem is
>                 resolved in the
>                 >         latest
>                 >         > version of the trunk.  I am now back to
>                 the initial problem
>                 >         I was
>                 >         > hoping this version would solve.  When I
>                 call
>                 >         playAndGetDigits() it
>                 >         > crashes Freeswitch.  The console dump from
>                 the
>                 >         playAndGetDigits call
>                 >         > to the crash is pasted below.  What would
>                 you suggest is the
>                 >         next
>                 >         > step to diagnose and fix this issue?
>                 >         >
>                 >         > Jonathan
>                 >         >
>                 >         >
>                 >         > Freeswitch console output:
>                 >         >
>                 >         > 2008-04-04 22:39:50 [NOTICE]
>                 switch_cpp.cpp:509
>                 >         console_log()
>                 >         > playAndGetDigits called next!!!
>                 >         > 2008-04-04 22:39:50 [DEBUG]
>                 switch_cpp.cpp:154 execute()
>                 >         > CoreSession::execute.  app: sleep data:500
>                 >         > 2008-04-04 22:39:50 [DEBUG]
>                 switch_ivr_play_say.c:1225
>                 >         > switch_play_and_get_digits()
>                 >         switch_play_and_get_digits(session, 10,
>                 >         > 20, 3, 30000,
>                 >
>                 #, /usr/local/freeswitch/sounds/DialNumber.wav, /usr/
>                 >         > local/freeswitch/sounds/NotAsDialed.wav,
>                 digit_buffer, 128,
>                 >         > XXXXXXXXXX)
>                 >         > *** glibc detected *** ./freeswitch:
>                 free(): invalid
>                 >         pointer:
>                 >         > 0x08cf29d0 ***
>                 >         > ======= Backtrace: =========
>                 >         > /lib/libc.so.6[0x3a0f41]
>                 >         > /lib/libc.so.6(cfree+0x90)[0x3a4580]
>                 >         > /lib/libc.so.6[0x3bae6f]
>                 >         > /lib/libc.so.6(tzset+0x3d)[0x3bb77d]
>                 >         > /lib/libc.so.6(strftime_l+0x46)[0x3c0006]
>                 >         > /lib/libc.so.6(strftime+0x3f)[0x3bff5f]
>                 >
>                 > /usr/local/freeswitch/lib/libfreeswitch.so.1(apr_strftime
>                 >         +0x85)
>                 >         > [0x19d395]
>                 >
>                 > /usr/local/freeswitch/lib/libfreeswitch.so.1(switch_strftime
>                 >         +0x39)
>                 >         > [0x13a139]
>                 >
>                 > /usr/local/freeswitch/lib/libfreeswitch.so.1(switch_log_printf+0x126)
>                 >         > [0x17f1f6]
>                 >
>                 > /usr/local/freeswitch/lib/libfreeswitch.so.
>                 >         > 1(switch_play_and_get_digits
>                 +0x192)[0x175ad2]
>                 >
>                 > /usr/local/freeswitch/lib/libfreeswitch.so.
>                 >         >
>                 1(_ZN11CoreSession16playAndGetDigitsEiiiiPcS0_S0_S0_S0_
>                 >         +0xe2)
>                 >         > [0x188242]
>                 >         > /usr/local/freeswitch/mod/
>                 >         > mod_java
>                 >         > .so
>                 >         >
>                 >
>                 (Java_org_freeswitch_swig_freeswitchJNI_CoreSession_1playAndGetDigits
>                 >         > +0x15d)[0xe46f3d]
>                 >
>                 >
>                 >
>                 _______________________________________________
>                 >         Freeswitch-dev mailing list
>                 >         Freeswitch-dev at lists.freeswitch.org
>                 >
>                 http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev
>                 >
>                 UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev
>                 >         http://www.freeswitch.org
>                 >
>                 > _______________________________________________
>                 > Freeswitch-dev mailing list
>                 > Freeswitch-dev at lists.freeswitch.org
>                 >
>                 http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev
>                 >
>                 UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev
>                 > http://www.freeswitch.org
>                 
>                 
>                 _______________________________________________
>                 Freeswitch-dev mailing list
>                 Freeswitch-dev at lists.freeswitch.org
>                 http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev
>                 UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev
>                 http://www.freeswitch.org
>                 
>         
>         
> 
> _______________________________________________
> Freeswitch-dev mailing list
> Freeswitch-dev at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev
> http://www.freeswitch.org




More information about the Freeswitch-dev mailing list