Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

WebRTC over TCP: SRS crash when close the RTC publish. #4220

Open
suzp1984 opened this issue Nov 5, 2024 · 0 comments · May be fixed by #4222
Open

WebRTC over TCP: SRS crash when close the RTC publish. #4220

suzp1984 opened this issue Nov 5, 2024 · 0 comments · May be fixed by #4222
Labels
WebRTC WebRTC, RTC2RTMP or RTMP2RTC.

Comments

@suzp1984
Copy link
Contributor

suzp1984 commented Nov 5, 2024 •
edited
Loading

Describe the bug

SRS crash when close the RTC publish stream. The stream is published by RTC over TCP.

Version

7.0 (develop branch) and 6.0

To Reproduce

Steps to reproduce the behavior:

  1. config file based on conf/rtc.tcp.only.conf, change rtmp_to_rtc and rtc_to_rtmp to on.
rtc_over_tcp.conf 
listen              1935;
max_connections     1000;
daemon              off;
srs_log_tank        console;

http_server {
    enabled         on;
    listen          8080;
    dir             ./objs/nginx/html;
}

http_api {
    enabled         on;
    listen          1985;
}
stats {
    network         0;
}
rtc_server {
    enabled on;
    tcp {
        enabled on;
        listen 8000;
    }
    protocol tcp;
    # @see https://ossrs.net/lts/zh-cn/docs/v4/doc/webrtc#config-candidate
    candidate $CANDIDATE;
}

vhost __defaultVhost__ {
    rtc {
        enabled     on;
        # @see https://ossrs.net/lts/zh-cn/docs/v4/doc/webrtc#rtmp-to-rtc
        rtmp_to_rtc on;
        # @see https://ossrs.net/lts/zh-cn/docs/v4/doc/webrtc#rtc-to-rtmp
        rtc_to_rtmp on;
    }
    http_remux {
        enabled     on;
        mount       [vhost]/[app]/[stream].flv;
    }
}

./objs/srs -c rtc_over_tcp.conf
2. go to 'http://localhost:8080/players/whip.html?schema=http', try to publish your screenshot to SRS by RTC WHIP.
3. record the rtmp stream by ffmpeg: ffmpeg -re -i rtmp://localhost/live/livestream -c copy -f flv record_video.flv.
(this step may not necessary, I just want to play this stream).
4. close the RTC publish by stop screen sharing or close the web page.
5. check SRS process, it may be crashed occasionally.
crash frequency: (rarely only happened once in my pc)

Expected behavior
rtc over tcp works well without crash.

Crash logs

Crash logs 
[2024-11-04 14:59:15.886][INFO][45947][fc5a23p1] RTC: to rtmp bridge request key frame, ssrc=4092779376, publisher cid=4bh2p64v
[2024-11-04 14:59:16.830][INFO][45947][18o8n319] HTTP #0 127.0.0.1:62100 GET http://localhost:8080/players/whep.html?schema=http, content-length=-1
[2024-11-04 14:59:16.830][INFO][45947][18o8n319] http match file=./objs/nginx/html/players/whep.html, pattern=/, upath=/players/whep.html
[2024-11-04 14:59:17.046][INFO][45947][a9781ky9] Hybrid cpu=0.00%,0MB, cid=2,0, timer=61,10,48, clock=0,31,17,0,0,0,0,0,0, objs=(pkt:109,raw:81,fua:27,msg:280,oth:1,buf:79)
[2024-11-04 14:59:17.046][INFO][45947][a9781ky9] RTC: Server conns=1, spkts=(0,rtp:0,stun:1,rtcp:28), rtcp=(pli:1,twcc:9,rr:1), snk=(96,a:48,v:48,h:0)
[2024-11-04 14:59:17.054][INFO][45947][4bh2p64v] DTLS: After done, got 39 bytes
[2024-11-04 14:59:17.054][INFO][45947][4bh2p64v] DTLS: State Passive RECV, done=1, arq=0, r0=39, len=39, cnt=21, size=26, hs=0
[2024-11-04 14:59:17.054][WARN][45947][4bh2p64v][0] DTLS: SSL3 alert method=read type=warning, desc=CN(close notify), where=16388, ret=256, r1=0
[2024-11-04 14:59:17.054][INFO][45947][4bh2p64v] RTC: session destroy by DTLS alert(warning CN), username=9786n773:HJYa
[2024-11-04 14:59:17.054][INFO][45947][4bh2p64v] RTC: before dispose resource(RtcConn)(0x61b000001580), conns=1, zombies=0, ign=0, inz=0, ind=0
[2024-11-04 14:59:17.054][INFO][45947][4bh2p64v] RTC: session detach from [4bh2p64v](RtcConn), disposing=1
[2024-11-04 14:59:17.054][INFO][45947][4bh2p64v] RTC: before dispose resource(RtcConn)(0x61b000001580), conns=1, zombies=1, ign=1, inz=1, ind=0
[2024-11-04 14:59:17.054][WARN][45947][4bh2p64v][54] client disconnect peer. ret=1008
[2024-11-04 14:59:17.054][INFO][45947][ier03a83] RTC: before dispose resource(Tcp)(0x608000007920), conns=1, zombies=1, ign=0, inz=0, ind=0
[2024-11-04 14:59:17.055][INFO][45947][6o778l36] RTC: clear zombies=2 resources, conns=1, removing=0, unsubs=0
[2024-11-04 14:59:17.055][INFO][45947][4bh2p64v] RTC: disposing #0 resource(RtcConn)(0x61b000001580), conns=1, disposing=2, zombies=0
[2024-11-04 14:59:17.055][INFO][45947][ier03a83] RTC: disposing #1 resource(Tcp)(0x608000007920), conns=0, disposing=2, zombies=0
[2024-11-04 14:59:17.055][INFO][45947][ier03a83] cleanup when unpublish, created=1, deliver=1
[2024-11-04 14:59:17.055][INFO][45947][ier03a83] Qavg: 190.162
[2024-11-04 14:59:17.055][WARN][45947][ier03a83][54] 2 frames left in the queue on closing
[2024-11-04 14:59:17.061][INFO][45947][ier03a83] cleanup when unpublish
[2024-11-04 14:59:17.064][INFO][45947][32nx91ke] http: unmount flv stream for sid=/live/livestream, i=0
[2024-11-04 14:59:17.064][WARN][45947][ier03a83][4][DTLS_HANG] DTLS: Hang, done=0, version=-1, arq=0
[2024-11-04 14:59:17.064][INFO][45947][ier03a83] RTC: before dispose resource(Tcp)(0x60300004a6e0), conns=0, zombies=0, ign=0, inz=0, ind=0
[2024-11-04 14:59:17.064][INFO][45947][6o778l36] RTC: clear zombies=1 resources, conns=0, removing=0, unsubs=1
[2024-11-04 14:59:17.064][INFO][45947][ier03a83] RTC: disposing #0 resource(Tcp)(0x60300004a6e0), conns=0, disposing=1, zombies=0
=================================================================
==45947==ERROR: AddressSanitizer: heap-use-after-free on address 0x61b000001650 at pc 0x000100a7ff7c bp 0x000105ca3ce0 sp 0x000105ca3cd8
READ of size 8 at 0x61b000001650 thread T0
    #0 0x100a7ff78 in SrsRtcConnection::tcp() srs_app_rtc_conn.cpp:2286
    #1 0x100b5643c in SrsRtcTcpConn::cycle() srs_app_rtc_network.cpp:772
    #2 0x1007137d0 in SrsExecutorCoroutine::cycle() srs_app_st.cpp:424
    #3 0x100711bd0 in SrsFastCoroutine::cycle() srs_app_st.cpp:309
    #4 0x100711530 in SrsFastCoroutine::pfn(void*) srs_app_st.cpp:324
    #5 0x100c0fabc in _st_thread_main sched.c:385
    #6 0x100c0e488 in st_thread_create sched.c:673

0x61b000001650 is located 208 bytes inside of 1576-byte region [0x61b000001580,0x61b000001ba8)
freed by thread T0 here:
    #0 0x10204c2d4 in _ZdlPv+0x74 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x642d4)
    #1 0x100a6b8b4 in SrsRtcConnection::~SrsRtcConnection() srs_app_rtc_conn.cpp:1807
    #2 0x100606dd8 in SrsResourceManager::do_clear() srs_app_conn.cpp:351
    #3 0x1005fd84c in SrsResourceManager::clear() srs_app_conn.cpp:317
    #4 0x1005feb28 in SrsResourceManager::cycle() srs_app_conn.cpp:110
    #5 0x100711bd0 in SrsFastCoroutine::cycle() srs_app_st.cpp:309
    #6 0x100711530 in SrsFastCoroutine::pfn(void*) srs_app_st.cpp:324
    #7 0x100c0fabc in _st_thread_main sched.c:385
    #8 0x100c0e488 in st_thread_create sched.c:673

previously allocated by thread T0 here:
    #0 0x10204be94 in _Znwm+0x74 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x63e94)
    #1 0x100b7034c in SrsRtcServer::create_session(SrsRtcUserConfig*, SrsSdp&, SrsRtcConnection**) srs_app_rtc_server.cpp:515
    #2 0x100bf20d8 in SrsGoApiRtcPublish::serve_http(ISrsHttpResponseWriter*, ISrsHttpMessage*, SrsRtcUserConfig*) srs_app_rtc_api.cpp:508
    #3 0x100bf8848 in SrsGoApiRtcWhip::do_serve_http(ISrsHttpResponseWriter*, ISrsHttpMessage*, SrsRtcUserConfig*) srs_app_rtc_api.cpp:755
    #4 0x100bf53f0 in SrsGoApiRtcWhip::serve_http(ISrsHttpResponseWriter*, ISrsHttpMessage*) srs_app_rtc_api.cpp:645
    #5 0x10051d498 in SrsHttpServeMux::serve_http(ISrsHttpResponseWriter*, ISrsHttpMessage*) srs_protocol_http_stack.cpp:792
    #6 0x10052120c in SrsHttpAuthMux::serve_http(ISrsHttpResponseWriter*, ISrsHttpMessage*) srs_protocol_http_stack.cpp:983
    #7 0x100520640 in SrsHttpCorsMux::serve_http(ISrsHttpResponseWriter*, ISrsHttpMessage*) srs_protocol_http_stack.cpp:950
    #8 0x100860040 in SrsHttpConn::process_request(ISrsHttpResponseWriter*, ISrsHttpMessage*, int) srs_app_http_conn.cpp:234
    #9 0x10085f414 in SrsHttpConn::process_requests(SrsRequest**) srs_app_http_conn.cpp:207
    #10 0x10085e490 in SrsHttpConn::do_cycle() srs_app_http_conn.cpp:160
    #11 0x10085d4ac in SrsHttpConn::cycle() srs_app_http_conn.cpp:107
    #12 0x100711bd0 in SrsFastCoroutine::cycle() srs_app_st.cpp:309
    #13 0x100711530 in SrsFastCoroutine::pfn(void*) srs_app_st.cpp:324
    #14 0x100c0fabc in _st_thread_main sched.c:385
    #15 0x100c0e488 in st_thread_create sched.c:673

SUMMARY: AddressSanitizer: heap-use-after-free srs_app_rtc_conn.cpp:2286 in SrsRtcConnection::tcp()
Shadow bytes around the buggy address:
  0x61b000001380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x61b000001400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x61b000001480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x61b000001500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x61b000001580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x61b000001600: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd
  0x61b000001680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x61b000001700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x61b000001780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x61b000001800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x61b000001880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0] =================================================================
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0] ==45947==ERROR: AddressSanitizer: heap-use-after-free on address 0x61b000001650 at pc 0x000100a7ff7c bp 0x000105ca3ce0 sp 0x000105ca3cd8
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0] READ of size 8 at 0x61b000001650 thread T0
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #0 0x100a7ff78 in SrsRtcConnection::tcp() srs_app_rtc_conn.cpp:2286, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #1 0x100b5643c in SrsRtcTcpConn::cycle() srs_app_rtc_network.cpp:772, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #2 0x1007137d0 in SrsExecutorCoroutine::cycle() srs_app_st.cpp:424, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #3 0x100711bd0 in SrsFastCoroutine::cycle() srs_app_st.cpp:309, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #4 0x100711530 in SrsFastCoroutine::pfn(void*) srs_app_st.cpp:324, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #5 0x100c0fabc in _st_thread_main sched.c:385, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #6 0x100c0e488 in st_thread_create sched.c:673, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0] 0x61b000001650 is located 208 bytes inside of 1576-byte region [0x61b000001580,0x61b000001ba8)
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0] freed by thread T0 here:
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #0 0x10204c2d4 in _ZdlPv+0x74 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x642d4), r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #1 0x100a6b8b4 in SrsRtcConnection::~SrsRtcConnection() srs_app_rtc_conn.cpp:1807, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #2 0x100606dd8 in SrsResourceManager::do_clear() srs_app_conn.cpp:351, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #3 0x1005fd84c in SrsResourceManager::clear() srs_app_conn.cpp:317, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #4 0x1005feb28 in SrsResourceManager::cycle() srs_app_conn.cpp:110, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #5 0x100711bd0 in SrsFastCoroutine::cycle() srs_app_st.cpp:309, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #6 0x100711530 in SrsFastCoroutine::pfn(void*) srs_app_st.cpp:324, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #7 0x100c0fabc in _st_thread_main sched.c:385, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #8 0x100c0e488 in st_thread_create sched.c:673, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0] previously allocated by thread T0 here:
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #0 0x10204be94 in _Znwm+0x74 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x63e94), r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #1 0x100b7034c in SrsRtcServer::create_session(SrsRtcUserConfig*, SrsSdp&, SrsRtcConnection**) srs_app_rtc_server.cpp:515, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #2 0x100bf20d8 in SrsGoApiRtcPublish::serve_http(ISrsHttpResponseWriter*, ISrsHttpMessage*, SrsRtcUserConfig*) srs_app_rtc_api.cpp:508, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #3 0x100bf8848 in SrsGoApiRtcWhip::do_serve_http(ISrsHttpResponseWriter*, ISrsHttpMessage*, SrsRtcUserConfig*) srs_app_rtc_api.cpp:755, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #4 0x100bf53f0 in SrsGoApiRtcWhip::serve_http(ISrsHttpResponseWriter*, ISrsHttpMessage*) srs_app_rtc_api.cpp:645, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #5 0x10051d498 in SrsHttpServeMux::serve_http(ISrsHttpResponseWriter*, ISrsHttpMessage*) srs_protocol_http_stack.cpp:792, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #6 0x10052120c in SrsHttpAuthMux::serve_http(ISrsHttpResponseWriter*, ISrsHttpMessage*) srs_protocol_http_stack.cpp:983, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #7 0x100520640 in SrsHttpCorsMux::serve_http(ISrsHttpResponseWriter*, ISrsHttpMessage*) srs_protocol_http_stack.cpp:950, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #8 0x100860040 in SrsHttpConn::process_request(ISrsHttpResponseWriter*, ISrsHttpMessage*, int) srs_app_http_conn.cpp:234, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #9 0x10085f414 in SrsHttpConn::process_requests(SrsRequest**) srs_app_http_conn.cpp:207, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #10 0x10085e490 in SrsHttpConn::do_cycle() srs_app_http_conn.cpp:160, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #11 0x10085d4ac in SrsHttpConn::cycle() srs_app_http_conn.cpp:107, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #12 0x100711bd0 in SrsFastCoroutine::cycle() srs_app_st.cpp:309, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #13 0x100711530 in SrsFastCoroutine::pfn(void*) srs_app_st.cpp:324, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #14 0x100c0fabc in _st_thread_main sched.c:385, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]     #15 0x100c0e488 in st_thread_create sched.c:673, r0=1092
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0] SUMMARY: AddressSanitizer: heap-use-after-free srs_app_rtc_conn.cpp:2286 in SrsRtcConnection::tcp()
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0] Shadow bytes around the buggy address:
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   0x61b000001380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   0x61b000001400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   0x61b000001480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   0x61b000001500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   0x61b000001580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0] =>0x61b000001600: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   0x61b000001680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   0x61b000001700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   0x61b000001780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   0x61b000001800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   0x61b000001880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0] Shadow byte legend (one shadow byte represents 8 application bytes):
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   Addressable:           00
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   Partially addressable: 01 02 03 04 05 06 07
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   Heap left redzone:       fa
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   Freed heap region:       fd
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   Stack left redzone:      f1
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   Stack mid redzone:       f2
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   Stack right redzone:     f3
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   Stack after return:      f5
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   Stack use after scope:   f8
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   Global redzone:          f9
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   Global init order:       f6
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   Poisoned by user:        f7
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   Container overflow:      fc
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   Array cookie:            ac
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   Intra object redzone:    bb
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   ASan internal:           fe
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   Left alloca redzone:     ca
[2024-11-04 14:59:18.237][ERROR][45947][4bh2p64v][0]   Right alloca redzone:    cb
==45947==ABORTING
Abort trap: 6

Cause

According to above crash stack and logs.

The SrsRtcConnection, which is the RTC over tcp publish connection, is freed by [INFO][45947][4bh2p64v] RTC: session destroy by DTLS alert(warning CN), username=9786n773:HJYa

srs/trunk/src/app/srs_app_rtc_conn.cpp

Lines 2262 to 2263 in 7951bf3

srs_trace("RTC: session destroy by DTLS alert(%s %s), username=%s", type.c_str(), desc.c_str(), username_.c_str());
_srs_rtc_manager->remove(this);

then this resource still referred by SrsRtcTcpConn, when TCP connection is broken.

srs/trunk/src/app/srs_app_rtc_network.cpp

Lines 763 to 775 in 7951bf3

srs_error_t SrsRtcTcpConn::cycle()
{
srs_error_t err = do_cycle();
// Only stat the HTTP streaming clients, ignore all API clients.
SrsStatistic::instance()->on_disconnect(get_id().c_str(), err);
SrsStatistic::instance()->kbps_add_delta(get_id().c_str(), delta_);
// Only remove session when network is established, because client might use other UDP network.
if(session_ && session_->tcp()->is_establelished()) {
session_->tcp()->set_state(SrsRtcNetworkStateClosed);
session_->expire();
}

the session_ is the SrsRtcConnection instance.
@winlinvip winlinvip added the EnglishNative This issue is conveyed exclusively in English. label Nov 5, 2024
@suzp1984 suzp1984 added WebRTC WebRTC, RTC2RTMP or RTMP2RTC. and removed EnglishNative This issue is conveyed exclusively in English. labels Nov 5, 2024
suzp1984 added a commit to suzp1984/srs that referenced this issue Nov 5, 2024
@suzp1984
fix rtc over tcp crash when stop rtc publish.
629bce3 
@see ossrs#4220
@suzp1984 suzp1984 linked a pull request Nov 5, 2024 that will close this issue
Open
suzp1984 added a commit to suzp1984/srs that referenced this issue Nov 5, 2024
@suzp1984
fix rtc over tcp crash when stop rtc publish.
a12ddbb 
@see ossrs#4220
suzp1984 added a commit to suzp1984/srs that referenced this issue Nov 5, 2024
@suzp1984
fix rtc over tcp crash when stop rtc publish.
393a6e3 
@see ossrs#4220
suzp1984 added a commit to suzp1984/srs that referenced this issue Nov 8, 2024
@suzp1984
fix rtc over tcp crash when stop rtc publish.
7dd5439 
@see ossrs#4220
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
WebRTC WebRTC, RTC2RTMP or RTMP2RTC.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix rtc over tcp crash when stop rtc publish. suzp1984/srs
2 participants
@suzp1984 @winlinvip