Skip to content

WebRTC: SRS 5 docker crash when RTMP2RTC over TCP. #3784

@namnm

Description

@namnm

Note: Please read FAQ before file an issue, see #2716

Description

While I was testing with rtmp to webrtc, the webrtc stream worked well. Then I refreshed the browser, and srs crashed

  1. SRS Version: 5

  2. SRS Log:

[2023-08-26 02:12:23.990][INFO][1][85uf3e42] HTTP #0 172.19.0.1:43648 GET http://localhost:8080/players/rtc_player.html?autostart=true, content-length=-1
[2023-08-26 02:12:23.991][INFO][1][85uf3e42] http match file=./objs/nginx/html/players/rtc_player.html, pattern=/, upath=/players/rtc_player.html
[2023-08-26 02:12:23.993][INFO][1][85uf3e42] TCP: before dispose resource(HttpConn)(0x60700005e7b0), conns=3, zombies=0, ign=0, inz=0, ind=0
[2023-08-26 02:12:23.993][WARN][1][85uf3e42][104] client disconnect peer. ret=1007
[2023-08-26 02:12:23.993][INFO][1][95fw2y11] TCP: clear zombies=1 resources, conns=3, removing=0, unsubs=0
[2023-08-26 02:12:23.993][INFO][1][85uf3e42] TCP: disposing #0 resource(HttpConn)(0x60700005e7b0), conns=3, disposing=1, zombies=0
[2023-08-26 02:12:24.004][INFO][1][5114w0fh] DTLS: After done, got 39 bytes
[2023-08-26 02:12:24.004][INFO][1][5114w0fh] DTLS: State Passive RECV, done=1, arq=0, r0=39, len=39, cnt=21, size=26, hs=0
[2023-08-26 02:12:24.005][WARN][1][5114w0fh][0] DTLS: SSL3 alert method=read type=warning, desc=CN(close notify), where=16388, ret=256, r1=0
[2023-08-26 02:12:24.005][INFO][1][5114w0fh] RTC: session destroy by DTLS alert(warning CN), username=p81x7808:tctP
[2023-08-26 02:12:24.005][INFO][1][5114w0fh] RTC: before dispose resource(RtcConn)(0x61d000194680), conns=1, zombies=0, ign=0, inz=0, ind=0
[2023-08-26 02:12:24.005][INFO][1][5114w0fh] RTC: session detach from [5114w0fh](RtcConn), disposing=1
[2023-08-26 02:12:24.005][INFO][1][5114w0fh] RTC: tcp conn diposing, because of rtc connection
[2023-08-26 02:12:24.005][INFO][1][396m2q82] TCP: before dispose resource(Tcp)(0x60c0000a4b00), conns=2, zombies=0, ign=0, inz=0, ind=0
[2023-08-26 02:12:24.005][ERROR][1][5114w0fh][0] serve error code=1070(StThreadInterrupt)(ST thread is interrupted) : rtc tcp conn : interrupted
thread [1][5114w0fh]: do_cycle() [./src/app/srs_app_rtc_network.cpp:811][errno=0]
thread [1][5114w0fh]: interrupt() [./src/app/srs_app_st.cpp:257][errno=0]
[2023-08-26 02:12:24.005][INFO][1][e0i043rg] RTC: clear zombies=1 resources, conns=1, removing=0, unsubs=2
[2023-08-26 02:12:24.005][INFO][1][5114w0fh] RTC: disposing #0 resource(RtcConn)(0x61d000194680), conns=1, disposing=1, zombies=0
[2023-08-26 02:12:24.005][INFO][1][95fw2y11] TCP: clear zombies=1 resources, conns=2, removing=0, unsubs=0
[2023-08-26 02:12:24.005][INFO][1][396m2q82] TCP: disposing #0 resource(Tcp)(0x60c0000a4b00), conns=2, disposing=1, zombies=0
=================================================================
==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x6040013a9358 at pc 0x5646a13fec4f bp 0x7f57effffd60 sp 0x7f57effffd50
READ of size 8 at 0x6040013a9358 thread T1 (srs-hybrid-2)
    #0 0x5646a13fec4e in SrsRtcTcpNetwork::write(void*, unsigned long, long*) src/app/srs_app_rtc_network.cpp:672
    #1 0x5646a1389e3b in SrsRtcConnection::do_send_packet(SrsRtpPacket*) src/app/srs_app_rtc_conn.cpp:2472
    #2 0x5646a143e0c2 in SrsRtcAudioSendTrack::on_rtp(SrsRtpPacket*) src/app/srs_app_rtc_source.cpp:2804
    #3 0x5646a1374461 in SrsRtcPlayStream::send_packet(SrsRtpPacket*&) src/app/srs_app_rtc_conn.cpp:734
    #4 0x5646a1373254 in SrsRtcPlayStream::cycle() src/app/srs_app_rtc_conn.cpp:669
    #5 0x5646a10f5e93 in SrsFastCoroutine::cycle() src/app/srs_app_st.cpp:285
    #6 0x5646a10f5fe3 in SrsFastCoroutine::pfn(void*) src/app/srs_app_st.cpp:300
    #7 0x5646a14a70c9 in _st_thread_main /srs/trunk/objs/Platform-SRS5-Linux-5.15.0-GCC9.4.0-x86_64/st-srs/sched.c:380
    #8 0x5646a14a79ef in st_thread_create /srs/trunk/objs/Platform-SRS5-Linux-5.15.0-GCC9.4.0-x86_64/st-srs/sched.c:666

0x6040013a9358 is located 8 bytes inside of 48-byte region [0x6040013a9350,0x6040013a9380)
freed by thread T1 (srs-hybrid-2) here:
    #0 0x5646a0ddbf6f in operator delete(void*) (/usr/local/srs/objs/srs+0x4aef6f)

previously allocated by thread T1 (srs-hybrid-2) here:
    #0 0x5646a0ddafd7 in operator new(unsigned long) (/usr/local/srs/objs/srs+0x4adfd7)

Thread T1 (srs-hybrid-2) created by T0 here:
    #0 0x5646a0d06295 in pthread_create (/usr/local/srs/objs/srs+0x3d9295)
    #1 0x5646a1333697 in SrsThreadPool::execute(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, SrsCplxError* (*)(void*), void*) src/app/srs_app_threads.cpp:671
    #2 0x5646a14a59fe in run_in_thread_pool() src/main/srs_main_server.cpp:517
    #3 0x5646a14a5466 in run_directly_or_daemon() src/main/srs_main_server.cpp:456
    #4 0x5646a14a25c2 in do_main(int, char**, char**) src/main/srs_main_server.cpp:245
    #5 0x5646a14a28dd in main src/main/srs_main_server.cpp:256
    #6 0x7f57f7aa5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)

SUMMARY: AddressSanitizer: heap-use-after-free src/app/srs_app_rtc_network.cpp:672 in SrsRtcTcpNetwork::write(void*, unsigned long, long*)
Shadow bytes around the buggy address:
  0x0c088026d210: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
  0x0c088026d220: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 fa
  0x0c088026d230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c088026d240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c088026d250: fa fa fa fa fa fa fa fa fa fa fd fd fd fa fa fa
=>0x0c088026d260: fa fa fd fd fd fa fa fa fa fa fd[fd]fd fd fd fd
  0x0c088026d270: fa fa fd fd fd fa fa fa fa fa fa fa fa fa fa fa
  0x0c088026d280: fa fa fa fa fa fa fa fa fa fa fd fd fd fd fd fa
  0x0c088026d290: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
  0x0c088026d2a0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c088026d2b0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
[2023-08-26 02:12:24.054][ERROR][1][5114w0fh][0] =================================================================
[2023-08-26 02:12:24.054][ERROR][1][5114w0fh][0] ==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x6040013a9358 at pc 0x5646a13fec4f bp 0x7f57effffd60 sp 0x7f57effffd50
[2023-08-26 02:12:24.054][ERROR][1][5114w0fh][0] READ of size 8 at 0x6040013a9358 thread T1 (srs-hybrid-2)
[2023-08-26 02:12:24.054][ERROR][1][5114w0fh][0]     #0 0x5646a13fec4e in SrsRtcTcpNetwork::write(void*, unsigned long, long*) src/app/srs_app_rtc_network.cpp:672, r0=1093
[2023-08-26 02:12:24.054][ERROR][1][5114w0fh][0]     #1 0x5646a1389e3b in SrsRtcConnection::do_send_packet(SrsRtpPacket*) src/app/srs_app_rtc_conn.cpp:2472, r0=1093
[2023-08-26 02:12:24.054][ERROR][1][5114w0fh][0]     #2 0x5646a143e0c2 in SrsRtcAudioSendTrack::on_rtp(SrsRtpPacket*) src/app/srs_app_rtc_source.cpp:2804, r0=1093
[2023-08-26 02:12:24.054][ERROR][1][5114w0fh][0]     #3 0x5646a1374461 in SrsRtcPlayStream::send_packet(SrsRtpPacket*&) src/app/srs_app_rtc_conn.cpp:734, r0=1093
[2023-08-26 02:12:24.054][ERROR][1][5114w0fh][0]     #4 0x5646a1373254 in SrsRtcPlayStream::cycle() src/app/srs_app_rtc_conn.cpp:669, r0=1093
[2023-08-26 02:12:24.054][ERROR][1][5114w0fh][0]     #5 0x5646a10f5e93 in SrsFastCoroutine::cycle() src/app/srs_app_st.cpp:285, r0=1093
[2023-08-26 02:12:24.054][ERROR][1][5114w0fh][0]     #6 0x5646a10f5fe3 in SrsFastCoroutine::pfn(void*) src/app/srs_app_st.cpp:300, r0=1093
[2023-08-26 02:12:24.054][ERROR][1][5114w0fh][0]     #7 0x5646a14a70c9 in _st_thread_main /srs/trunk/objs/Platform-SRS5-Linux-5.15.0-GCC9.4.0-x86_64/st-srs/sched.c:380, r0=1093
[2023-08-26 02:12:24.054][ERROR][1][5114w0fh][0]     #8 0x5646a14a79ef in st_thread_create /srs/trunk/objs/Platform-SRS5-Linux-5.15.0-GCC9.4.0-x86_64/st-srs/sched.c:666, r0=1093
[2023-08-26 02:12:24.054][ERROR][1][5114w0fh][0] 0x6040013a9358 is located 8 bytes inside of 48-byte region [0x6040013a9350,0x6040013a9380)
[2023-08-26 02:12:24.054][ERROR][1][5114w0fh][0] freed by thread T1 (srs-hybrid-2) here:
sh: 1: addr2line: not found
[2023-08-26 02:12:24.057][ERROR][1][5114w0fh][0]     #0 0x5646a0ddbf6f in operator delete(void*) (/usr/local/srs/objs/srs+0x4aef6f), r0=1094
[2023-08-26 02:12:24.057][ERROR][1][5114w0fh][0] previously allocated by thread T1 (srs-hybrid-2) here:
[2023-08-26 02:12:24.057][ERROR][1][5114w0fh][0]     #0 0x5646a0ddafd7 in operator new(unsigned long) (/usr/local/srs/objs/srs+0x4adfd7), r0=1094
[2023-08-26 02:12:24.057][ERROR][1][5114w0fh][0] Thread T1 (srs-hybrid-2) created by T0 here:
sh: 1: addr2line: not found
sh: 1: addr2line: not found
[2023-08-26 02:12:24.058][ERROR][1][5114w0fh][0]     #0 0x5646a0d06295 in pthread_create (/usr/local/srs/objs/srs+0x3d9295), r0=1094
[2023-08-26 02:12:24.058][ERROR][1][5114w0fh][0]     #1 0x5646a1333697 in SrsThreadPool::execute(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, SrsCplxError* (*)(void*), void*) src/app/srs_app_threads.cpp:671, r0=1093
[2023-08-26 02:12:24.058][ERROR][1][5114w0fh][0]     #2 0x5646a14a59fe in run_in_thread_pool() src/main/srs_main_server.cpp:517, r0=1093
[2023-08-26 02:12:24.058][ERROR][1][5114w0fh][0]     #3 0x5646a14a5466 in run_directly_or_daemon() src/main/srs_main_server.cpp:456, r0=1093
[2023-08-26 02:12:24.058][ERROR][1][5114w0fh][0]     #4 0x5646a14a25c2 in do_main(int, char**, char**) src/main/srs_main_server.cpp:245, r0=1093
[2023-08-26 02:12:24.058][ERROR][1][5114w0fh][0]     #5 0x5646a14a28dd in main src/main/srs_main_server.cpp:256, r0=1093
sh: 1: addr2line: not found
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]     #6 0x7f57f7aa5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082), r0=1094
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0] SUMMARY: AddressSanitizer: heap-use-after-free src/app/srs_app_rtc_network.cpp:672 in SrsRtcTcpNetwork::write(void*, unsigned long, long*)
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0] Shadow bytes around the buggy address:
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   0x0c088026d210: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   0x0c088026d220: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 fa
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   0x0c088026d230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   0x0c088026d240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   0x0c088026d250: fa fa fa fa fa fa fa fa fa fa fd fd fd fa fa fa
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0] =>0x0c088026d260: fa fa fd fd fd fa fa fa fa fa fd[fd]fd fd fd fd
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   0x0c088026d270: fa fa fd fd fd fa fa fa fa fa fa fa fa fa fa fa
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   0x0c088026d280: fa fa fa fa fa fa fa fa fa fa fd fd fd fd fd fa
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   0x0c088026d290: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   0x0c088026d2a0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   0x0c088026d2b0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0] Shadow byte legend (one shadow byte represents 8 application bytes):
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   Addressable:           00
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   Partially addressable: 01 02 03 04 05 06 07 
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   Heap left redzone:       fa
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   Freed heap region:       fd
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   Stack left redzone:      f1
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   Stack mid redzone:       f2
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   Stack right redzone:     f3
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   Stack after return:      f5
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   Stack use after scope:   f8
[2023-08-26 02:12:24.061][ERROR][1][5114w0fh][0]   Global redzone:          f9
==1==ABORTING
[2023-08-26 02:12:24.062][ERROR][1][5114w0fh][0]   Global init order:       f6
[2023-08-26 02:12:24.062][ERROR][1][5114w0fh][0]   Poisoned by user:        f7
[2023-08-26 02:12:24.062][ERROR][1][5114w0fh][0]   Container overflow:      fc
[2023-08-26 02:12:24.062][ERROR][1][5114w0fh][0]   Array cookie:            ac
[2023-08-26 02:12:24.062][ERROR][1][5114w0fh][0]   Intra object redzone:    bb
[2023-08-26 02:12:24.062][ERROR][1][5114w0fh][0]   ASan internal:           fe
[2023-08-26 02:12:24.062][ERROR][1][5114w0fh][0]   Left alloca redzone:     ca
[2023-08-26 02:12:24.062][ERROR][1][5114w0fh][0]   Right alloca redzone:    cb
[2023-08-26 02:12:24.062][ERROR][1][5114w0fh][0]   Shadow gap:              cc

  1. SRS Config:
listen 1935;
daemon off;
srs_log_tank console;
# srs_log_level warn;

srt_server {
  enabled on;
  listen 10080;
}

rtc_server {
  enabled on;
  protocol tcp;
  candidate 192.168.5.234;
  tcp {
    enabled on;
    listen 8000;
  }
}
http_api {
  enabled on;
  listen 1985;
  crossdomain on;
}
http_server {
  enabled on;
  listen 8080;
  dir ./objs/nginx/html;
}

vhost __defaultVhost__ {
  rtc {
    enabled on;
    rtmp_to_rtc on;
  }
  http_remux {
    enabled on;
    mount [vhost]/[app]/[stream].flv;
    hstrs on;
  }
}

Replay

While I was testing with rtmp to webrtc, the webrtc stream worked well. Then I refreshed the browser, and srs crashed

Expect

Do not crash

Metadata

Metadata

Assignees

Labels

EnglishNativeThis issue is conveyed exclusively in English.WebRTCWebRTC, RTC2RTMP or RTMP2RTC.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions