Pjproject - Bug report

JH
Jan Hetych
Thu, Sep 13, 2018 11:42 AM

Hello,
I would like to report bug. I have not found any other option than sending
this email. Bug is here on line 966:

https://github.com/pjsip/pjproject/blob/master/pjsip/src/pjsua-lib/pjsua_
acc.c

It happens when you modify account to the lowest priority out of all
accounts. For example 3 accounts have priority 1 and you modify first
account to priority 0.

/* Resort accounts priority */
    for (i=0; i<pjsua_var.acc_cnt; ++i) {
        if (pjsua_var.acc_ids[i] == acc_id)
        break;
    }
    pj_assert(i < pjsua_var.acc_cnt);
    pj_array_erase(pjsua_var.acc_ids, sizeof(acc_id),  pjsua_var.acc_cnt,
i);
    for (i=0; i<pjsua_var.acc_cnt; ++i) { // SHOULD BE: for (i=0; i<pjsua_
var.acc_cnt-1; ++i)  ...because one item was removed from acc_ids[]
        if (pjsua_var.acc[pjsua_var.acc_ids[i]].cfg.priority <   acc->cfg.
priority) // if others accounts priority > than current accout priority,
this never pass
        {
        break;
        }
    }
// variable "i" will be = pjsua_var.acc_cnt which is out of array
    pj_array_insert(pjsua_var.acc_ids, sizeof(acc_id),    pjsua_var.acc_cnt,
i, &acc_id); // acc_id is inserted to array index acc_cnt which is out of
bounds

Thanks for fixing bug,
Jan

Hello, I would like to report bug. I have not found any other option than sending this email. Bug is here on line 966: https://github.com/pjsip/pjproject/blob/master/pjsip/src/pjsua-lib/pjsua_ acc.c It happens when you modify account to the lowest priority out of all accounts. For example 3 accounts have priority 1 and you modify first account to priority 0. /* Resort accounts priority */     for (i=0; i<pjsua_var.acc_cnt; ++i) {         if (pjsua_var.acc_ids[i] == acc_id)         break;     }     pj_assert(i < pjsua_var.acc_cnt);     pj_array_erase(pjsua_var.acc_ids, sizeof(acc_id),  pjsua_var.acc_cnt, i);     for (i=0; i<pjsua_var.acc_cnt; ++i) { // SHOULD BE: for (i=0; i<pjsua_ var.acc_cnt-1; ++i)  ...because one item was removed from acc_ids[]         if (pjsua_var.acc[pjsua_var.acc_ids[i]].cfg.priority <   acc->cfg. priority) // if others accounts priority > than current accout priority, this never pass         {         break;         }     } // variable "i" will be = pjsua_var.acc_cnt which is out of array     pj_array_insert(pjsua_var.acc_ids, sizeof(acc_id),    pjsua_var.acc_cnt, i, &acc_id); // acc_id is inserted to array index acc_cnt which is out of bounds Thanks for fixing bug, Jan