<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
Here is one bug about stack-use-after-return in live.2023.05.10 running in Ubuntu 20.04. It happens while handling the SETUP client request.</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
You can reproduce this bug as the README in the attachment. It is one flaky bug as we observed. The following is the ASAN bug report:</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
=================================================================
<div class="ContentPasted0">==98936==ERROR: AddressSanitizer: stack-use-after-return on address 0x7ffff4688360 at pc 0x00000043bfdb bp 0x7fffffffd480 sp 0x7fffffffcc08</div>
<div class="ContentPasted0">READ of size 2 at 0x7ffff4688360 thread T0</div>
<div class="ContentPasted0"> #0 0x43bfda in printf_common(void*, char const*, __va_list_tag*) (/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer+0x43bfda)</div>
<div class="ContentPasted0"> #1 0x43d860 in snprintf (/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer+0x43d860)</div>
<div class="ContentPasted0"> #2 0x4da7b1 in RTSPServer::RTSPClientSession::handleCmd_SETUP_afterLookup2(ServerMediaSession*) /home/ubuntu/experiments/live/liveMedia/RTSPServer.cpp</div>
<div class="ContentPasted0"> #3 0x4d716c in RTSPServer::RTSPClientConnection::handleRequestBytes(int) /home/ubuntu/experiments/live/liveMedia/RTSPServer.cpp:887:19</div>
<div class="ContentPasted0"> #4 0x5b7a66 in GenericMediaServer::ClientConnection::incomingRequestHandler() /home/ubuntu/experiments/live/liveMedia/GenericMediaServer.cpp:324:3</div>
<div class="ContentPasted0"> #5 0x605e35 in BasicTaskScheduler::SingleStep(unsigned int) /home/ubuntu/experiments/live/BasicUsageEnvironment/BasicTaskScheduler.cpp:153:7</div>
<div class="ContentPasted0"> #6 0x60c409 in BasicTaskScheduler0::doEventLoop(char volatile*) /home/ubuntu/experiments/live/BasicUsageEnvironment/BasicTaskScheduler0.cpp:82:5</div>
<div class="ContentPasted0"> #7 0x4ca479 in main /home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer.cpp:462:24</div>
<div class="ContentPasted0"> #8 0x7ffff770a082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16</div>
<div class="ContentPasted0"> #9 0x41d73d in _start (/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer+0x41d73d)</div>
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">Address 0x7ffff4688360 is located in stack of thread T0 at offset 864 in frame</div>
<div class="ContentPasted0"> #0 0x4d575f in RTSPServer::RTSPClientConnection::handleRequestBytes(int) /home/ubuntu/experiments/live/liveMedia/RTSPServer.cpp:699</div>
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0"> This frame has 14 object(s):</div>
<div class="ContentPasted0"> [32, 36) 'decodedSize' (line 743)</div>
<div class="ContentPasted0"> [48, 248) 'cmdName' (line 788)</div>
<div class="ContentPasted0"> [320, 520) 'urlPreSuffix' (line 789)</div>
<div class="ContentPasted0"> [592, 792) 'urlSuffix' (line 790)</div>
<div class="ContentPasted0"> [864, 1064) 'cseq' (line 791) <== Memory access at offset 864 is inside this variable</div>
<div class="ContentPasted0"> [1136, 1336) 'sessionIdStr' (line 792)</div>
<div class="ContentPasted0"> [1408, 1412) 'contentLength' (line 793)</div>
<div class="ContentPasted0"> [1424, 1425) 'urlIsRTSPS' (line 794)</div>
<div class="ContentPasted0"> [1440, 1840) 'urlTotalSuffix' (line 871)</div>
<div class="ContentPasted0"> [1904, 1905) 'reuseConnection' (line 914)</div>
<div class="ContentPasted0"> [1920, 1921) 'deliverViaTCP' (line 914)</div>
<div class="ContentPasted0"> [1936, 1944) 'proxyURLSuffix' (line 915)</div>
<div class="ContentPasted0"> [1968, 2168) 'sessionCookie' (line 933)</div>
<div class="ContentPasted0"> [2240, 2440) 'acceptStr' (line 934)</div>
<div class="ContentPasted0">HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork</div>
<div class="ContentPasted0"> (longjmp and C++ exceptions *are* supported)</div>
<div class="ContentPasted0">SUMMARY: AddressSanitizer: stack-use-after-return (/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer+0x43bfda) in printf_common(void*, char const*, __va_list_tag*)</div>
<div class="ContentPasted0">Shadow bytes around the buggy address:</div>
<div class="ContentPasted0"> 0x10007e8c9010: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5</div>
<div class="ContentPasted0"> 0x10007e8c9020: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5</div>
<div class="ContentPasted0"> 0x10007e8c9030: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5</div>
<div class="ContentPasted0"> 0x10007e8c9040: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5</div>
<div class="ContentPasted0"> 0x10007e8c9050: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5</div>
<div class="ContentPasted0">=>0x10007e8c9060: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5[f5]f5 f5 f5</div>
<div class="ContentPasted0"> 0x10007e8c9070: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5</div>
<div class="ContentPasted0"> 0x10007e8c9080: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5</div>
<div class="ContentPasted0"> 0x10007e8c9090: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5</div>
<div class="ContentPasted0"> 0x10007e8c90a0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5</div>
<div class="ContentPasted0"> 0x10007e8c90b0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5</div>
<div class="ContentPasted0">Shadow byte legend (one shadow byte represents 8 application bytes):</div>
<div class="ContentPasted0"> Addressable: 00</div>
<div class="ContentPasted0"> Partially addressable: 01 02 03 04 05 06 07 </div>
<div class="ContentPasted0"> Heap left redzone: fa</div>
<div class="ContentPasted0"> Freed heap region: fd</div>
<div class="ContentPasted0"> Stack left redzone: f1</div>
<div class="ContentPasted0"> Stack mid redzone: f2</div>
<div class="ContentPasted0"> Stack right redzone: f3</div>
<div class="ContentPasted0"> Stack after return: f5</div>
<div class="ContentPasted0"> Stack use after scope: f8</div>
<div class="ContentPasted0"> Global redzone: f9</div>
<div class="ContentPasted0"> Global init order: f6</div>
<div class="ContentPasted0"> Poisoned by user: f7</div>
<div class="ContentPasted0"> Container overflow: fc</div>
<div class="ContentPasted0"> Array cookie: ac</div>
<div class="ContentPasted0"> Intra object redzone: bb</div>
<div class="ContentPasted0"> ASan internal: fe</div>
<div class="ContentPasted0"> Left alloca redzone: ca</div>
<div class="ContentPasted0"> Right alloca redzone: cb</div>
<div class="ContentPasted0"> Shadow gap: cc</div>
<div class="ContentPasted0">==98936==ABORTING</div>
Aborted (core dumped) </div>
<div class="elementToProof">
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
</div>
<div style="font-family: "Times New Roman", Times, serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-size: 11pt; font-family: Verdana, Geneva, sans-serif;">------</span></div>
<div style="font-family: "Times New Roman", Times, serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-size: 11pt; font-family: Verdana, Geneva, sans-serif;">Kind Regards,</span></div>
<div style="font-family: "Times New Roman", Times, serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-size: 11pt; font-family: Verdana, Geneva, sans-serif;">Ruijie</span></div>
</div>
</div>
</div>
</body>
</html>