Skip to content

fix: extract rtp capabilities crash - #218

Merged
jmillan merged 4 commits into
versatica:v3from
VLprojects:bugfix/192-extract-rtp-capabilities-crash
Sep 14, 2026
Merged

jmillan merged 4 commits into
versatica:v3from
VLprojects:bugfix/192-extract-rtp-capabilities-crash

Conversation

@AlexanderPanaev

@AlexanderPanaev AlexanderPanaev commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

Fixes #192.

Hit this on Android, libmediasoupclient 3.5.0 + libwebrtc M140. Reproduces when the only m=audio section in the SDP is rejected and a video produce runs. We only got there by alternating the mic and camera buttons quickly.

The offer at that moment, the live video section and the rejected audio one:

  m=video 55603 UDP/TLS/RTP/SAVPF 96 97 98 ...                                                                                                                                       
  a=mid:0                                                                                                                                                                            
  a=sendonly                                                                                                                                                                         
  a=extmap:1 ... a=extmap:14                       <- 13 extmap lines                                                                                                                
  a=rtpmap:96 VP8/90000                                                                                                                                                              
                                                                                                                                                                                     
  m=audio 0 UDP/TLS/RTP/SAVPF 111 63 9 0 8 13 110 126                                                                                                                                
  a=mid:44                                                                                                                                                                           
  a=inactive                                                                                                                                                                         
  a=rtpmap:111 opus/48000/2                                                                                                                                                          
  a=rtcp-fb:111 transport-cc                                                                                                                                                         
  a=fmtp:111 minptime=10;useinbandfec=1            <- no extmap at all    

Utils.cpp:136 then reads a key that is not there, on a const json&:

for (const auto& ext : m["ext"])

The call is a video produce, but it dies on the audio section - the mic was off, so the only m=audio in the SDP was the rejected one.

[DEBUG] Handler::Send() | [kind:video, track->id():ARDAMSv0]
[TRACE] PeerConnection::CreateOffer()
[TRACE] Sdp::Utils::extractRtpCapabilities()
[ERROR] transport_jni::JNI_SendTransport_Produce() | [json.exception.type_error.305] cannot use operator[] with a string argument with number

@ibc

ibc commented Sep 12, 2026

Copy link
Copy Markdown
Member

This is not the proper fix. Port could be != 0 and still there could be no a=ext lines and it would crash the same way. All the fields must be checked before iterating them. It's a global bug in that code.

@AlexanderPanaev

Copy link
Copy Markdown
Contributor Author

Got it, thanks. I applied an approach similar to the fix @richmonkey, who reported #192, made in his fork (richmonkey@a9578ad), but only guarding the arrays before iterating, as mediasoup-client does for fmtp, rtcpFb and ext
(commonUtils.ts).

All four arrays (rtp, fmtp, rtcpFb, ext) are checked. rtp and fmtp are always set by the parser (parser.cpp), but I kept the check for consistency.

@jmillan

jmillan commented Sep 14, 2026

Copy link
Copy Markdown
Member

@AlexanderPanaev can you please run npm run lint to fix the lint issues?

@AlexanderPanaev

Copy link
Copy Markdown
Contributor Author

@AlexanderPanaev can you please run npm run lint to fix the lint issues?

local npm run lint is fine, ci failed because it cannon install clang-format.

@jmillan

jmillan commented Sep 14, 2026

Copy link
Copy Markdown
Member

Yes. Fixed. Can you please merge the latest v3?

@AlexanderPanaev

Copy link
Copy Markdown
Contributor Author

Yes. Fixed. Can you please merge the latest v3?

Done.

@jmillan

jmillan commented Sep 14, 2026

Copy link
Copy Markdown
Member

Thanks @AlexanderPanaev 👍

@jmillan
jmillan merged commit 83923f9 into versatica:v3 Sep 14, 2026
2 checks passed
@AlexanderPanaev
AlexanderPanaev deleted the bugfix/192-extract-rtp-capabilities-crash branch September 15, 2026 04:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

when ext field not exits, extractRtpCapabilities crash

3 participants