<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<small>Hi<br>
<br>
We've had a number of Yealink T22 & T28 phones with later <br>
firmware crashing within approx 30 seconds of sending <br>
and receiving RTP.<br>
Yealink R&D department have narrowed it down to a<br>
non-standard RTCP 'Sender Report' packet from FreeSWITCH.<br>
For some packet content, the length field in these packets <br>
does not seem to agree with the overall UDP packet size. <br>
RFC1889 defines the length as:<br>
"The length of this RTCP packet in 32-bit words minus one, <br>
including the header and any padding."<br>
For instance, below is a RTCP packet sent from FS as viewed <br>
in Wireshark. The length field says 76 bytes but the udp packet <br>
length is 78 bytes so the last two bytes (0x31, 0x00) are excluded<br>
as far as the length field is concerned.<br>
<br>
<img src="cid:part1.05060409.04010204@redmatter.com" alt=""><br>
I managed to stop the phones crashing by changing the following
lines<br>
in switch_rtp.c...<br>
<small><tt> rtcp_bytes = sizeof(switch_rtcp_hdr_t) +
sizeof(struct switch_rtcp_senderinfo) +
sr->sr_desc_ssrc.length -1 ;</tt><tt><br>
</tt><tt> rtp_session->rtcp_send_msg.header.length =
htons((u_short)(rtcp_bytes / 4) - 1); </tt><tt><br>
</tt></small>...to something like...<br>
<tt><small> {<br>
switch_size_t rtcp_bytes_mod4;<br>
rtcp_bytes = sizeof(switch_rtcp_hdr_t) + sizeof(struct
switch_rtcp_senderinfo) + sr->sr_desc_ssrc.length -1 ;<br>
// Add padding and adjust length if necessary<br>
rtcp_bytes_mod4 = rtcp_bytes % 4;<br>
if (rtcp_bytes_mod4 > 0)<br>
rtcp_bytes += 4 - rtcp_bytes_mod4;<br>
rtp_session->rtcp_send_msg.header.length =
htons((u_short)(rtcp_bytes / 4 - 1)); <br>
}<br>
</small></tt>although Freeswitch developers will probably find a
better solution.<br>
<br>
Thanks in advance,<br>
James Bravo, <br>
Redmatter<br>
</small><br>
</body>
</html>