Core dump on eventhandlers

[david-goncalves]

We are noticing some core dumps related to event handlers.
We have Janus configured with the video room plugin with talking events enabled.
After some events we have SIGABRT on json_decref(output);

The initial core dump was noticed using the rabbitmqevent module.
The gdb output could be consulted on the following link: https://pastebin.com/WA6DRQyj.

To verify if the core dump was related to rabbitmq, we decided to change the event handler to the sampleevh.
After some tests, we received another core dump now on sampleevh.
The core dump can be consulted on the following link: https://pastebin.com/Lss6LFE0.

With Address Sanitizer active, we couldn't replicate the problem.

[lminiero]

Is this master? We fixed something on event handlers just a few days ago.

[david-goncalves]

Yes the core dump generated today was with the last commit on master (1a825c4)

--

[lminiero]

Without a libasan dump (and apparently it works for you with libasan active), hard to tell: the gdb stacktrace only mentions an abort on a free. Possibly something related to the json object references, but not sure if/how those can be tracked.

[atoppi]

Worth noting that in

#21 0x00007f23a7d3bd08 in janus_sampleevh_handler (data=<optimized out>) at events/janus_sampleevh.c:783
        res = <optimized out>
        headers = <optimized out>
        curl = <optimized out>
        __FUNCTION__ = "janus_sampleevh_handler"
        event = <optimized out>
        output = 0x7f239000c000
        event_text = 0x7f23900219d0 ""
        compressed_text = '\000' <repeats 8032 times>...
        compressed_len = 0
        count = <optimized out>
        max = 1
        retransmit = <optimized out>

it is showed that:
event_text = 0x7f23900219d0 ""

event_text should be the string representation of the JSON object.

[atoppi]

@david-goncalves anything helpful from the janus log?

[david-goncalves]

I don't think so.
The pastebin with the last event is the following: https://pastebin.com/pfixBQAd.

The only message missing from the event is the one acknowledge the success
[Thu Sep 3 15:43:56 2020] [events/janus_sampleevh.c:janus_sampleevh_handler:770] Event sent!

[lminiero]

Unfortunately I can't replicate the issue, even with libasan disabled.

[david-goncalves]

@lminiero the line https://github.com/meetecho/janus-gateway/blob/master/plugins/janus_videoroom.c#L4936 should be "json_object_set_new(event,..." or "json_object_set_new(info,..."

The coredumps that we notice are always related with talking events.

[lminiero]

Argh you're right, that's an ugly typo there... we're setting something on event that we just unreffed before! I'll fix it right away.

[lminiero]

Just pushed, and I'll assume this fixes it. Please let me know if that's not the case.