PJSUA Android: App Crashes Due to Assertion Failure After Sending DTMF Signal

[DeepumonDev]

Describe the bug

After calling an IVR number and sending a DTMF signal using RFC2833 method, an assertion error occurs, causing the app to crash. This issue happens with only one specific IVR number, while signaling works fine for the other two numbers used for testing.

override fun sendDTMFRFCMethod(digit: String) {
    try {
        val dtmfParam = getDTMFParam(DTMFType.OUT_OF_BAND_RFC283, digit)
        activeAudioCall!!.sendDtmf(dtmfParam)
    } catch (e: Exception) {
        // Fall back: RFC Method is not supported, Try sending DTMF signal using SIP INFO Method
        sendDTMFSIPINFOMethod(digit)
    }
}

override fun sendDTMFSIPINFOMethod(digit: String) {
    try {
        val dtmfParam = getDTMFParam(DTMFType.OUT_OF_BAND_SIP_INFO, digit)
        activeAudioCall!!.sendDtmf(dtmfParam)
    } catch (e: Exception) {
    }
}

override fun getDTMFParam(dtmfType: DTMFType, digit: String): CallSendDtmfParam {
    val dtmfParam = CallSendDtmfParam().apply {
        when (dtmfType) {
            DTMFType.OUT_OF_BAND_RFC283 -> {
                method = PJSUA_DTMF_METHOD_RFC2833
            }

            DTMFType.OUT_OF_BAND_SIP_INFO -> {
                method = PJSUA_DTMF_METHOD_SIP_INFO
            }

            else -> {
                method = PJSUA_DTMF_METHOD_RFC2833
            } // Defaults to RFC method
        }

        digits = digit
    }
    return dtmfParam
}

Steps to reproduce

1. Build PJSIP(2.15.1) for Android kotlin project.
2. make a call to the given IVR Number
3. send a DTMF signal using RFC2833 method (combination that caused the crash for that particular number: send DTMF digit 1 and then send 2).
4. The app crashes due to the following assertion failure.

assertion "a->addr.sa_family == PJ_AF_INET || a->addr.sa_family == PJ_AF_INET6" failed

PJSIP version

2.15.1

Context

• The issue happens on Android Samsung Galaxy Tab A8 device (didn't try on any other devices).
• Android version: 11
• Device architecture: arm64-v8a
• PJSIP version: 2.15.1 or 2.14.1.
• Command used to configure PJSIP for Android: TARGET_ABI=arm64-v8a ./configure-android --use-ndk-cflags.
• Contents of config_site.h file.
  #define PJ_CONFIG_ANDROID 1
  #include <pj/config_site_sample.h>

Log, call stack, etc

Call 0 sending DTMF 2 using RFC2833 method 
Call 0 dialing DTMF 2 Sending DTMF digit id 2 
stop(436): called with 10560 frames delivered Processing incoming message: Request msg INVITE/cseq=101 (rdata0xb400007e4469f8f8) RX 1230 bytes 
Request msg INVITE/cseq=101 (rdata0xb400007e4469f8f8) from UDP 10.150.80.121:5060: 

INVITE sip:[email protected]:6000;ob SIP/2.0 Via: SIP/2.0/UDP 10.150.80.121:5060;branch=z9hG4bK17f25543f7fb1e From: sip:[email protected];tag=31526615~91396a45-835e-4589-ae6e-b55e6289590f-57548461 To: sip:[email protected];tag=129e016a-a62f-4af5-8bd5-526095a2669a Date: Wed, 19 Feb 2025 18:07:20 GMT Call-ID: 12aae1ac-5822-4544-bcf0-f90ba691c4da 

Supported: timer,resource-priority,replaces User-Agent: Cisco-CUCM11.5 
Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, 
NOTIFY CSeq: 101 INVITE Max-Forwards: 70 Expires: 180 
Allow-Events: presence Session-ID: f15919f7090757d4c047cba117440776;remote=ce0c7aebfe567511ed864faa31526615 

Session-Expires: 1800;refresher=uac Min-SE: 1800 Remote-Party-ID: <sip:[email protected].121>;party=calling;screen=yes;privacy=off Contact: <sip:[email protected]:5060;transport=tcp> 
Content-Type: application/sdp Content-Length: 261 v=0 
o=CiscoSystemsCCM-SIP 31526615 2 IN IP4 10.150.80.121 
s=SIP Call 
c=IN IP4 0.0.0.0 
b=TIAS:64000 
b=AS:64 
t=0 0 
m=audio 25676 RTP/AVP 0 122 b=TIAS:64000 a=ptime:20 
a=rtpmap:0 PCMU/8000 a=inactive 
a=rtpmap:122 telephone-event/8000 a=fmtp:122 0-15

dlg0xb400007e14818908 .Received Request msg INVITE/cseq=101 (rdata0xb400007e4469f8f8) tsx0xb400007de46ca0e8 ...Transaction created for Request msg INVITE/cseq=101 (rdata0xb400007e4469f8f8) tsx0xb400007de46ca0e8 ..Incoming Request msg INVITE/cseq=101 (rdata0xb400007e4469f8f8) in state Null tsx0xb400007de46ca0e8 ...State changed from Null to Trying, event=RX_MSG dlg0xb400007e14818908 ....Transaction tsx0xb400007de46ca0e8 state changed to Trying inv0xb400007e14818908 .....Got SDP offer in Request msg INVITE/cseq=101 (rdata0xb400007e4469f8f8) 
pjsua_call.c .....Call 0: received updated media offer 
pjsua_media.c ......Call 0: re-initializing media..
pjsua_media.c .......Media index 0 selected for audio call 0 
pjsua_media.c .......Call 0: media transport initialization complete: Success sip_util.c .....Response msg 200/INVITE/cseq=101 (tdta0xb400007e149168d8) created inv0xb400007e14818908 .....SDP negotiation done: Success pjsua_call.c ......Call 0:
 remote NAT type is 0 (Unknown) pjsua_media.c ......Call 0: updating media.. 
pjsua_media.c .......Local address change detected, resetting SRTP TX ROC 
pjsua_media.c .......Remote address change detected, resetting SRTP RX ROC
 conference.c .........Remove port 1 requested
 conference.c .........Remove port 1 queued 
strm0xb400007e446ea128 ........Stream destroying 
pjsua_media.c ........Media stream call00:0 is destroyed 
pjsua_aud.c .......Audio channel update for index 0 for call 0…
 strm0xb400007e4471d2a8 ........VAD temporarily disabled
 strm0xb400007e4471d2a8 ........Jitter buffer reset 
rtp.c ........pjmedia_rtp_session_init: ses=0xb400007e44718038, default_pt=0, ssrc=0x2fe83998 rtp.c ........pjmedia_rtp_session_init2: ses=0xb400007e44718038, seq=13823, ts=105760, peer_ssrc=0 rtp.c ........pjmedia_rtp_session_init: ses=0xb400007e44718658, default_pt=0, ssrc=0x2fe83998 rtp.c ........pjmedia_rtp_session_init2: ses=0xb400007e44718658, seq=13823, ts=105760, peer_ssrc=0


conference.c !.Stop any transmission to port 1 (sip:+[[email protected]](mailto:[email protected]):5060)
 conference.c .Port 0 (Android JNI) stop transmitting to port 1 (sip:[email protected]:5060) 
Master/sound .Delay buffer is reset 
conference.c .Stop any transmission from port 1 (sip:+[[email protected]](mailto:[email protected]):5060)
conference.c .Port 1 (sip:[email protected]:5060) 
stop transmitting to port 0 (Android JNI) conference.c .Removed port 1 (sip:[email protected]:5060), port count=1 strm0xb400007e446ea128 .JB summary: size=0/eff=0 prefetch=0 level=0 delay (min/max/avg/dev)=0/0/0/0 ms burst (min/max/avg/dev)=0/0/0/0 frames lost=0 discard=0 empty=654 strm0xb400007e446ea128 .Stream destroyed capdbuf Underflow, buf_cnt=0, will generate 1 frame

libc A ../src/pj/sock_common.c:394: unsigned int pj_sockaddr_get_len(const pj_sockaddr_t *): assertion "a->addr.sa_family == PJ_AF_INET || a->addr.sa_family == PJ_AF_INET6" failed libc 

—---------------Beginning of crash—-----------------------------

Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 26141 (Thread-1474), pid 23767 

pid: 23767, tid: 26141, name: Thread-1474 
#02 pc 00000000004eac80 /lib/arm64/libpjsua2.so (pj_sockaddr_get_len+192) (BuildId: 83555015a1b45b5c31db836f25fd0e603538b350)
#03 pc 000000000040d1c0 /lib/arm64/libpjsua2.so (BuildId: 83555015a1b45b5c31db836f25fd0e603538b350)
#04 pc 0000000000414bac /lib/arm64/libpjsua2.so (BuildId: 83555015a1b45b5c31db836f25fd0e603538b350)
#05 pc 0000000000413a64 /lib/arm64/libpjsua2.so (BuildId: 83555015a1b45b5c31db836f25fd0e603538b350)
#06 pc 00000000004139fc /lib/arm64/libpjsua2.so (BuildId: 83555015a1b45b5c31db836f25fd0e603538b350) 
#07 pc 00000000003ffabc /lib/arm64/libpjsua2.so (BuildId: 83555015a1b45b5c31db836f25fd0e603538b350) 
#08 pc 00000000003fd1ec /lib/arm64/libpjsua2.so (BuildId: 83555015a1b45b5c31db836f25fd0e603538b350) 
#09 pc 00000000003fcc5c /lib/arm64/libpjsua2.so (pjmedia_stream_send_rtcp_sdes+120) (BuildId: 83555015a1b45b5c31db836f25fd0e603538b350) 
#10 pc 00000000003f9e74 /lib/arm64/libpjsua2.so (pjmedia_stream_create+5848) (BuildId: 83555015a1b45b5c31db836f25fd0e603538b350) 
#11 pc 00000000003519dc /lib/arm64/libpjsua2.so (pjsua_aud_channel_update+692) (BuildId: 83555015a1b45b5c31db836f25fd0e603538b350) 
#12 pc 00000000003438d8 /lib/arm64/libpjsua2.so (pjsua_media_channel_update+3088) (BuildId: 83555015a1b45b5c31db836f25fd0e603538b350) 
#13 pc 00000000003231ac /lib/arm64/libpjsua2.so (BuildId: 83555015a1b45b5c31db836f25fd0e603538b350)
 #14 pc 000000000035f0ac /lib/arm64/libpjsua2.so (BuildId: 83555015a1b45b5c31db836f25fd0e603538b350) #15 pc 000000000035b594 /lib/arm64/libpjsua2.so (BuildId: 83555015a1b45b5c31db836f25fd0e603538b350) #16 pc 00000000003612c4 /lib/arm64/libpjsua2.so (BuildId: 83555015a1b45b5c31db836f25fd0e603538b350) #17 pc 000000000035e494 /lib/arm64/libpjsua2.so

[sauwming]

When I tested it here, it seemed to work fine.
The key difference is here:

10:02:57.045          pjsua_media.c  .......audio updated, stream #0: PCMU (inactive)
...
10:03:29.064            pjsua_aud.c  .Media is not established yet!
10:03:29.064                          Unable to send DTMF: Invalid operation (PJ_EINVALIDOP) [status=70013]

The first line seems to be missing from your log (i.e. the media should be set as inactive which would later prevent the DTMF sending). I'm not sure what the cause though, it could be due to race condition because it looked like you were trying to send DTMF when there's an incoming re-INVITE? If so, can you enable the time in your log (PJ_LOG_HAS_TIME), so we can know the sequence of events, and upload the log as text attachment.

[DeepumonDev]

Hi @sauwming Thanks for your help,

Please find the attached log file. Let me know if you need any additional details.

log_output.txt

[sauwming]

This seems to have nothing to do with DTMF since the log showed that it's been sent and it happened some ~0.5 sec before the crash:

02-24 14:48:37.098  9137  9137 I System.out: 14:48:37.098           pjsua_call.c !Call 0 sending DTMF 2 using RFC2833 method
02-24 14:48:37.098  9137  9137 I System.out: 14:48:37.098            pjsua_aud.c  Call 0 dialing DTMF 2

The most likely cause is the media teardown due to the incoming re-INVITE which hasn't completed. Please test it with the latest master, in particular I believe the issue may be related to #4301.