Hi We've had a number of Yealink T22 & T28 phones with later firmware crashing within approx 30 seconds of sending and receiving RTP. Yealink R&D department have narrowed it down to a non-standard RTCP 'Sender Report' packet from FreeSWITCH. For some packet content, the length field in these packets does not seem to agree with the overall UDP packet size. RFC1889 defines the length as: "The length of this RTCP packet in 32-bit words minus one, including the header and any padding." For instance, below is a RTCP packet sent from FS as viewed in Wireshark. The length field says 76 bytes but the udp packet length is 78 bytes so the last two bytes (0x31, 0x00) are excluded as far as the length field is concerned. I managed to stop the phones crashing by changing the following lines in switch_rtp.c... rtcp_bytes = sizeof(switch_rtcp_hdr_t) + sizeof(struct switch_rtcp_senderinfo) + sr->sr_desc_ssrc.length -1 ; rtp_session->rtcp_send_msg.header.length = htons((u_short)(rtcp_bytes / 4) - 1); ...to something like... { switch_size_t rtcp_bytes_mod4; rtcp_bytes = sizeof(switch_rtcp_hdr_t) + sizeof(struct switch_rtcp_senderinfo) + sr->sr_desc_ssrc.length -1 ; // Add padding and adjust length if necessary rtcp_bytes_mod4 = rtcp_bytes % 4; if (rtcp_bytes_mod4 > 0) rtcp_bytes += 4 - rtcp_bytes_mod4; rtp_session->rtcp_send_msg.header.length = htons((u_short)(rtcp_bytes / 4 - 1)); } although Freeswitch developers will probably find a better solution. Thanks in advance, James Bravo, Redmatter
