[Bug]: FATAL Bad cast to belle_sdp_rtcp_fb_attribute_t

[xuoguoto]

Context

linphone app on android crashes when an INVITE message is received from Kamailio/RTPEngine. This is always reproducible.

General information

==== Phone information dump ====
DEVICE=mido
MODEL=Redmi Note 4
MANUFACTURER=Xiaomi
ANDROID SDK=30
ABIs=arm64-v8a, armeabi-v7a, armeabi
=========================================
==== Linphone SDK information dump ====
VERSION=5.0.49
BRANCH=tags/5.0.49^0
PLUGINS=libmsaaudio.so, libmswebrtc.so, libmsandroidcamera2.so
PACKAGE=org.linphone.core
BUILD TYPE=release
=========================================
==== Previous exit reason information dump ====
REASON=Native crash
TIMESTAMP=09-02-2022 17:00:05
DESCRIPTION=crash

Expected behaviour

SIP/2.0 100 Trying message should be sent

To Reproduce

This is the debug log with the offending invite message. This can be reproduced always by connecting to our SIP server. A SIP/2.0 200 OK to an invite with SDP payload too will trigger this crash.

2022-02-09 17:00:04:085 [org.linphone/belle-sip] MESSAGE channel [0x7ad40fc040]: received [1852] new bytes from [TLS://abc-staging-q01.virtualabcdefg.ab:5061]:
INVITE sip:[email protected]:43549;transport=tls SIP/2.0
Record-Route: <sip:123.119.59.172:5061;transport=tls;r2=on;lr=on;did=ed5.4691>
Record-Route: <sip:10.10.1.9;r2=on;lr=on;did=ed5.4691>
Via: SIP/2.0/TLS 123.119.59.172:5061;branch=z9hG4bK808.2c76294260575fd296cfc6c22544d767.0
Via: SIP/2.0/UDP 10.10.1.10:7000;received=10.10.1.10;rport=7000;branch=z9hG4bKPj8975cb6d-078f-4dc3-a739-93a31d7b3df5
From: "Anonymous" <sip:[email protected]>;tag=2ffca2d6-0ca0-4682-8d07-e9769c305a63
To: <sip:[email protected]>
Contact: <sip:[email protected]:7000>
Call-ID: bf353c13-154b-4076-8bf5-a2ca0c65e364
CSeq: 21654 INVITE
Allow: OPTIONS, REGISTER, SUBSCRIBE, NOTIFY, PUBLISH, INVITE, ACK, BYE, CANCEL, UPDATE, PRACK, MESSAGE, REFER
Supported: 100rel, timer, replaces, norefersub, histinfo
Session-Expires: 1800
Min-SE: 90
Max-Forwards: 69
User-Agent: Asterisk PBX 18.8.0
Content-Type: application/sdp
Content-Length:   882

v=0
o=- 1151468950 1151468950 IN IP4 10.10.1.10
s=Asterisk
c=IN IP4 123.119.59.172
t=0 0
a=msid-semantic:WMS *
m=audio 16412 UDP/TLS/RTP/SAVPF 107 101
a=connection:new
a=maxptime:20
a=ssrc:1658939059 cname:5078b547-7198-45f7-a45d-d5944bd16c89
a=msid:47768d56-cd31-4e02-8f04-92c6d6aa8c7a 85bac464-a581-463f-9ccd-e5d18b73c7c7
a=rtcp-fb:* transport-cc
a=mid:audio-0
a=rtpmap:107 opus/48000/2
a=fmtp:107 useinbandfec=1
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=sendrecv
a=rtcp:16413
a=rtcp-mux
a=setup:actpass
a=fingerprint:sha-256 79:17:01:06:8B:4F:47:55:EC:87:42:36:13:D5:47:12:EE:DD:97:2B:1E:F6:97:F7:51:A2:D3:00:D1:6F:69:60
a=ptime:20
a=ice-ufrag:9PRTtZCP
a=ice-pwd:XEjGrTslUAOzw6d4NJIvu6Pvhe
a=candidate:4bdsqL3EfN7XDGor 1 UDP 2130706431 123.119.59.172 16412 typ host
a=candidate:4bdsqL3EfN7XDGor 2 UDP 2130706430 123.119.59.172 16413 typ host


2022-02-09 17:00:04:098 [org.linphone/belle-sip] MESSAGE channel [0x7ad40fc040] [970] bytes parsed
2022-02-09 17:00:04:098 [org.linphone/belle-sip] MESSAGE channel [0x7ad40fc040] read [882] bytes of body from [abc-staging-q01.virtualabcdefg.ab:5061]
2022-02-09 17:00:04:102 [org.linphone/belle-sip] MESSAGE bellesip_wake_lock_acquire(): Android wake lock [belle-sip transaction(0x7b7bd9cb50)] acquired [ref=0x33aa]
2022-02-09 17:00:04:102 [org.linphone/belle-sip] MESSAGE bellesip_wake_lock_acquire(): cast long of wakelock 13226
2022-02-09 17:00:04:102 [org.linphone/belle-sip] MESSAGE transaction [0x7b7bd9cb50]: starting transaction background task with id=[33aa].
2022-02-09 17:00:04:103 [org.linphone/belle-sip] MESSAGE Changing [server] [INVITE] transaction [0x7b7bd9cb50], from state [INIT] to [PROCEEDING]
2022-02-09 17:00:04:103 [org.linphone/belle-sip] MESSAGE channel [0x7ad40fc040]: starting resolution of abc-staging-q01.virtualabcdefg.ab
2022-02-09 17:00:04:103 [org.linphone/belle-sip] MESSAGE channel[0x7ad40fc040]: entering state RES_IN_PROGRESS
2022-02-09 17:00:04:103 [org.linphone/belle-sip] MESSAGE transaction [0x7b7bcd2e90] channel state changed to [RES_IN_PROGRESS]
2022-02-09 17:00:04:103 [org.linphone/belle-sip] MESSAGE resconf using application supplied dns server list.
2022-02-09 17:00:04:103 [org.linphone/belle-sip] MESSAGE Resolver is using DNS server(s):
2022-02-09 17:00:04:103 [org.linphone/belle-sip] MESSAGE        fdf9:32a9:1aff::1
2022-02-09 17:00:04:104 [org.linphone/belle-sip] MESSAGE        192.168.1.1
2022-02-09 17:00:04:104 [org.linphone/belle-sip] MESSAGE        11.45.0.1
2022-02-09 17:00:04:104 [org.linphone/belle-sip] MESSAGE Resolver is not using connect().
2022-02-09 17:00:04:104 [org.linphone/belle-sip] MESSAGE resolver_process_data dns_res_check() in progress
2022-02-09 17:00:04:104 [org.linphone/belle-sip] MESSAGE DNS resolution awaiting response, queued to main loop
2022-02-09 17:00:04:105 [org.linphone/belle-sip] MESSAGE New server dialog [0x7b8bc9eb30] , local tag [JfcRZbd], remote tag [2ffca2d6-0ca0-4682-8d07-e9769c305a63]
2022-02-09 17:00:04:105 [org.linphone/liblinphone] MESSAGE op [0x7bdbd6e180] : setOrUpdateDialog() current=[0x0] new=[0x7b8bc9eb30]
2022-02-09 17:00:04:105 [org.linphone/liblinphone] MESSAGE New incoming call from ["Anonymous" <sip:[email protected]>] to [sip:[email protected]]
2022-02-09 17:00:04:111 [org.linphone/liblinphone] ERROR Unable to find media attribute capabilities for stream 0
2022-02-09 17:00:04:111 [org.linphone/liblinphone] ERROR Unable to find media transport capabilities for stream 0
2022-02-09 17:00:04:111 [org.linphone/liblinphone] ERROR Unable to find configurations for stream 0
2022-02-09 17:00:04:111 [org.linphone/liblinphone] ERROR Unable to find media attribute capabilities for stream 0
2022-02-09 17:00:04:111 [org.linphone/liblinphone] ERROR Unable to find media transport capabilities for stream 0
2022-02-09 17:00:04:111 [org.linphone/liblinphone] MESSAGE Found payload opus/48000 fmtp=useinbandfec=1
2022-02-09 17:00:04:111 [org.linphone/liblinphone] MESSAGE Found payload telephone-event/8000 fmtp=0-16
2022-02-09 17:00:04:112 [org.linphone/belle-sip] FATAL Bad cast to belle_sdp_rtcp_fb_attribute_t at /home/sberfini/Work/linphone-sdk-5.0/liblinphone/src/sal/sal_stream_description.cpp:1198
2022-02-09 17:00:06:743 [org.linphone/bctbx] WARNING  Encrypted VFS access a plain file /data/user/0/org.linphone/files/linphonercas read only. Kept it plain
2022-02-09 17:00:06:744 [org.linphone/bctbx] WARNING  Encrypted VFS access a plain file /data/user/0/org.linphone/files/linphonercas read only. Secret material setting ignored
2022-02-09 17:00:06:749 [org.linphone/linphone-android] MESSAGE [Application] Core context created 

Additional context

All SDK logs are available and can be shared privately.

SDK logs URL

No response