ossrs/srs

Crash RTC

Closed this issue · 2 comments

thegobot commented

SRS/5.0.224(Bee)

Aug 23 14:04:01 Schrodinger srs[1648214]: AddressSanitizer:DEADLYSIGNAL
Aug 23 14:04:01 Schrodinger srs[1648214]: =================================================================
Aug 23 14:04:01 Schrodinger srs[1648214]: ==1648214==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000000d8 (pc 0x57683baa4403 bp 0x78bc0dfb5680 sp 0x78bc0dfb5670 T1)
Aug 23 14:04:01 Schrodinger srs[1648214]: ==1648214==The signal is caused by a READ memory access.
Aug 23 14:04:01 Schrodinger srs[1648214]: ==1648214==Hint: address points to the zero page.
Aug 23 14:04:01 Schrodinger srs[1648214]:     #0 0x57683baa4403 in SrsRtpPacket::get_avsync_time() const src/kernel/srs_kernel_rtc_rtp.hpp:339
Aug 23 14:04:01 Schrodinger srs[1648214]:     #1 0x57683ba96391 in SrsRtmpFromRtcBridge::packet_video_rtmp(unsigned short, unsigned short) src/app/srs_app_rtc_source.cpp:1733
Aug 23 14:04:01 Schrodinger srs[1648214]:     #2 0x57683ba93498 in SrsRtmpFromRtcBridge::packet_video(SrsRtpPacket*) src/app/srs_app_rtc_source.cpp:1524
Aug 23 14:04:01 Schrodinger srs[1648214]:     #3 0x57683ba91c14 in SrsRtmpFromRtcBridge::on_rtp(SrsRtpPacket*) src/app/srs_app_rtc_source.cpp:1420
Aug 23 14:04:01 Schrodinger srs[1648214]:     #4 0x57683ba881a6 in SrsRtcSource::on_rtp(SrsRtpPacket*) src/app/srs_app_rtc_source.cpp:639
Aug 23 14:04:01 Schrodinger srs[1648214]:     #5 0x57683baa0ee8 in SrsRtcVideoRecvTrack::on_rtp(SrsRtcSource*, SrsRtpPacket*) src/app/srs_app_rtc_source.cpp:2645
Aug 23 14:04:01 Schrodinger srs[1648214]:     #6 0x57683b9dd88b in SrsRtcPublishStream::do_on_rtp_plaintext(SrsRtpPacket*&, SrsBuffer*) src/app/srs_app_rtc_conn.cpp:1436
Aug 23 14:04:01 Schrodinger srs[1648214]:     #7 0x57683b9dd2a4 in SrsRtcPublishStream::on_rtp_plaintext(char*, int) src/app/srs_app_rtc_conn.cpp:1404
Aug 23 14:04:01 Schrodinger srs[1648214]:     #8 0x57683b9e6884 in SrsRtcConnection::on_rtp_plaintext(char*, int) src/app/srs_app_rtc_conn.cpp:2178
Aug 23 14:04:01 Schrodinger srs[1648214]:     #9 0x57683ba5cba2 in SrsRtcUdpNetwork::on_rtp(char*, int) src/app/srs_app_rtc_network.cpp:281
Aug 23 14:04:01 Schrodinger srs[1648214]:     #10 0x57683ba7554d in SrsRtcServer::on_udp_packet(SrsUdpMuxSocket*) src/app/srs_app_rtc_server.cpp:437
Aug 23 14:04:01 Schrodinger srs[1648214]:     #11 0x57683b927cb2 in SrsUdpMuxListener::cycle() src/app/srs_app_listener.cpp:733
Aug 23 14:04:01 Schrodinger srs[1648214]:     #12 0x57683b74eaf8 in SrsFastCoroutine::cycle() src/app/srs_app_st.cpp:285
Aug 23 14:04:01 Schrodinger srs[1648214]:     #13 0x57683b74ec43 in SrsFastCoroutine::pfn(void*) src/app/srs_app_st.cpp:300
Aug 23 14:04:01 Schrodinger srs[1648214]:     #14 0x57683bad9315 in _st_thread_main /root/srs/trunk/objs/Platform-SRS5-Linux-6.11.0-GCC13.3.0-x86_64/st-srs/sched.c:380
Aug 23 14:04:01 Schrodinger srs[1648214]:     #15 0x57683bad9c4a in st_thread_create /root/srs/trunk/objs/Platform-SRS5-Linux-6.11.0-GCC13.3.0-x86_64/st-srs/sched.c:666
Aug 23 14:04:01 Schrodinger srs[1648214]:     #16 0x57683b74d65a in SrsFastCoroutine::SrsFastCoroutine(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, ISrsCoroutineHandler*,>
Aug 23 14:04:01 Schrodinger srs[1648214]:     #17 0x78bc0b7fe78f  (<unknown module>)
Aug 23 14:04:01 Schrodinger srs[1648214]: AddressSanitizer can not provide additional info.
Aug 23 14:04:01 Schrodinger srs[1648214]: SUMMARY: AddressSanitizer: SEGV src/kernel/srs_kernel_rtc_rtp.hpp:339 in SrsRtpPacket::get_avsync_time() const
Aug 23 14:04:01 Schrodinger srs[1648214]: Thread T1 created by T0 here:
Aug 23 14:04:01 Schrodinger srs[1648214]:     #0 0x57683b3799b5 in __interceptor_pthread_create (/usr/local/srs/objs/srs+0x3c99b5) (BuildId: 08ce6b25b1d7e505e6a03b0bdef895cbfa13fb0f)
Aug 23 14:04:01 Schrodinger srs[1648214]:     #1 0x57683b991860 in SrsThreadPool::execute(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, SrsCplxError* (*)(void*), void*) sr>
Aug 23 14:04:01 Schrodinger srs[1648214]:     #2 0x57683bad7af1 in run_in_thread_pool() src/main/srs_main_server.cpp:475
Aug 23 14:04:01 Schrodinger srs[1648214]:     #3 0x57683bad752b in run_directly_or_daemon() src/main/srs_main_server.cpp:414
Aug 23 14:04:01 Schrodinger srs[1648214]:     #4 0x57683bad4cb5 in do_main(int, char**, char**) src/main/srs_main_server.cpp:242
Aug 23 14:04:01 Schrodinger srs[1648214]:     #5 0x57683bad4fcf in main src/main/srs_main_server.cpp:253
Aug 23 14:04:01 Schrodinger srs[1648214]:     #6 0x78bc0e82a1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
Aug 23 14:04:01 Schrodinger srs[1648214]:     #7 0x78bc0e82a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
Aug 23 14:04:01 Schrodinger srs[1648214]:     #8 0x57683b356774 in _start (/usr/local/srs/objs/srs+0x3a6774) (BuildId: 08ce6b25b1d7e505e6a03b0bdef895cbfa13fb0f)
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0] =================================================================
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0] ==1648214==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000000d8 (pc 0x57683baa4403 bp 0x78bc0dfb56>
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0] ==1648214==The signal is caused by a READ memory access.
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0] ==1648214==Hint: address points to the zero page.
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #0 0x57683baa4403 in SrsRtpPacket::get_avsync_time() const src/kernel/srs_kernel_rtc_rtp.hpp:339, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #1 0x57683ba96391 in SrsRtmpFromRtcBridge::packet_video_rtmp(unsigned short, unsigned short) src/app/srs_>
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #2 0x57683ba93498 in SrsRtmpFromRtcBridge::packet_video(SrsRtpPacket*) src/app/srs_app_rtc_source.cpp:152>
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #3 0x57683ba91c14 in SrsRtmpFromRtcBridge::on_rtp(SrsRtpPacket*) src/app/srs_app_rtc_source.cpp:1420, r0=>
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #4 0x57683ba881a6 in SrsRtcSource::on_rtp(SrsRtpPacket*) src/app/srs_app_rtc_source.cpp:639, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #5 0x57683baa0ee8 in SrsRtcVideoRecvTrack::on_rtp(SrsRtcSource*, SrsRtpPacket*) src/app/srs_app_rtc_sourc>
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #6 0x57683b9dd88b in SrsRtcPublishStream::do_on_rtp_plaintext(SrsRtpPacket*&, SrsBuffer*) src/app/srs_app>
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #7 0x57683b9dd2a4 in SrsRtcPublishStream::on_rtp_plaintext(char*, int) src/app/srs_app_rtc_conn.cpp:1404,>
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #8 0x57683b9e6884 in SrsRtcConnection::on_rtp_plaintext(char*, int) src/app/srs_app_rtc_conn.cpp:2178, r0>
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #9 0x57683ba5cba2 in SrsRtcUdpNetwork::on_rtp(char*, int) src/app/srs_app_rtc_network.cpp:281, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #10 0x57683ba7554d in SrsRtcServer::on_udp_packet(SrsUdpMuxSocket*) src/app/srs_app_rtc_server.cpp:437, r>
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #11 0x57683b927cb2 in SrsUdpMuxListener::cycle() src/app/srs_app_listener.cpp:733, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #12 0x57683b74eaf8 in SrsFastCoroutine::cycle() src/app/srs_app_st.cpp:285, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #13 0x57683b74ec43 in SrsFastCoroutine::pfn(void*) src/app/srs_app_st.cpp:300, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #14 0x57683bad9315 in _st_thread_main /root/srs/trunk/objs/Platform-SRS5-Linux-6.11.0-GCC13.3.0-x86_64/st>
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #15 0x57683bad9c4a in st_thread_create /root/srs/trunk/objs/Platform-SRS5-Linux-6.11.0-GCC13.3.0-x86_64/s>
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #16 0x57683b74d65a in SrsFastCoroutine::SrsFastCoroutine(std::__cxx11::basic_string<char, std::char_trait>
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #17 0x78bc0b7fe78f  (<unknown module>), r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0] AddressSanitizer can not provide additional info.
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0] SUMMARY: AddressSanitizer: SEGV src/kernel/srs_kernel_rtc_rtp.hpp:339 in SrsRtpPacket::get_avsync_time() const
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0] Thread T1 created by T0 here:
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.569][ERROR][1648214][a1284p61][0]     #0 0x57683b3799b5 in __interceptor_pthread_create (/usr/local/srs/objs/srs+0x3c99b5) (BuildId: 08ce6b25b1>
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.569][ERROR][1648214][a1284p61][0]     #1 0x57683b991860 in SrsThreadPool::execute(std::__cxx11::basic_string<char, std::char_traits<char>, std:>
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.569][ERROR][1648214][a1284p61][0]     #2 0x57683bad7af1 in run_in_thread_pool() src/main/srs_main_server.cpp:475, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.569][ERROR][1648214][a1284p61][0]     #3 0x57683bad752b in run_directly_or_daemon() src/main/srs_main_server.cpp:414, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.569][ERROR][1648214][a1284p61][0]     #4 0x57683bad4cb5 in do_main(int, char**, char**) src/main/srs_main_server.cpp:242, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.569][ERROR][1648214][a1284p61][0]     #5 0x57683bad4fcf in main src/main/srs_main_server.cpp:253, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.824][ERROR][1648214][a1284p61][0]     #6 0x78bc0e82a1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795>
Aug 23 14:04:02 Schrodinger srs[1648214]: [2025-08-23 14:04:02.067][ERROR][1648214][a1284p61][0]     #7 0x78bc0e82a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b660>
Aug 23 14:04:02 Schrodinger srs[1648214]: [2025-08-23 14:04:02.319][ERROR][1648214][a1284p61][0]     #8 0x57683b356774 in _start (/usr/local/srs/objs/srs+0x3a6774) (BuildId: 08ce6b25b1d7e505e6a03b0bdef895cb>
Aug 23 14:04:02 Schrodinger srs[1648214]: ==1648214==ABORTING
Aug 23 14:04:02 Schrodinger systemd[1]: srs.service: Main process exited, code=exited, status=1/FAILURE
Aug 23 14:04:02 Schrodinger systemd[1]: srs.service: Failed with result 'exit-code'.
Aug 23 14:04:02 Schrodinger systemd[1]: srs.service: Consumed 2d 7h 39min 16.647s CPU time, 1.8G memory peak, 19.9M memory swap peak.
Aug 23 14:04:02 Schrodinger systemd[1]: srs.service: Scheduled restart job, restart counter is at 6.
Aug 23 14:04:02 Schrodinger systemd[1]: Started srs.service - Srs PROD.
Aug 23 14:04:02 Schrodinger srs[2719909]: [2025-08-23 14:04:02.550][INFO][2719909][020a84h8] XCORE-SRS/5.0.224(Bee)
Aug 23 14:04:02 Schrodinger srs[2719909]: [2025-08-23 14:04:02.551][INFO][2719909][020a84h8] config parse complete
thegobot commented

Trace session a1284p61

journalctl -u srs -S "2025-08-23 13:00:10" --grep a1284p61 --no-pager

Aug 23 13:57:54 Schrodinger srs[1648214]: [2025-08-23 13:57:54.857][INFO][1648214][a1284p61] RTC whip play /__defaultApp__/vasya, clientip=127.0.0.1, app=__defaultApp__, stream=vasya, offer=6532B, eip=, codec=, srtp=, dtls=, ufrag=, pwd=, param=app=__defaultApp__&stream=vasya&ip=79.139.146.241&c=2&t=1755946672854
Aug 23 13:57:54 Schrodinger srs[1648214]: [2025-08-23 13:57:54.857][INFO][1648214][a1284p61] ignore attribute=, value=
Aug 23 13:57:54 Schrodinger srs[1648214]: [2025-08-23 13:57:54.859][INFO][1648214][a1284p61] RTC player nack=1, nnc=1
Aug 23 13:57:54 Schrodinger srs[1648214]: [2025-08-23 13:57:54.859][INFO][1648214][a1284p61] RTC connection player gcc=4
Aug 23 13:57:54 Schrodinger srs[1648214]: [2025-08-23 13:57:54.859][INFO][1648214][a1284p61] RTC: Init tracks {track: fcc39589-a3e0-49f6-8729-7d0a9c14235a, is_active: 0=>1},{track: 5cf02341-c6e9-4b8d-a6a4-47be4c5fad88, is_active: 0=>1}, ok
Aug 23 13:57:54 Schrodinger srs[1648214]: [2025-08-23 13:57:54.859][INFO][1648214][a1284p61] RTC: Use candidates x.x.x.x, protocol=udp
Aug 23 13:57:54 Schrodinger srs[1648214]: [2025-08-23 13:57:54.859][INFO][1648214][a1284p61] RTC init session, user=m47s2687:TWj9, url=/__defaultApp__/vasya, encrypt=1/1, DTLS(role=passive, version=auto), timeout=30000ms, nack=1
Aug 23 13:57:54 Schrodinger srs[1648214]: [2025-08-23 13:57:54.859][INFO][1648214][a1284p61] RTC username=m47s2687:TWj9, dtls=1, srtp=1, offer=6532B, answer=1917B
Aug 23 13:57:54 Schrodinger srs[1648214]: [2025-08-23 13:57:54.860][INFO][1648214][a1284p61] RTC remote offer: v=0\r\no=- 374180984666996747 2 IN IP4 127.0.0.1\r\ns=-\r\nt=0 0\r\na=group:BUNDLE 0 1\r\na=extmap-allow-mixed\r\na=msid-semantic: WMS\r\nm=video 9 UDP/TLS/RTP/SAVPF 96 97 98 99 100 101 35 36 37 38 102 103 104 105 106 107 108 109 127 125 39 40 41 42 43 44 45 46 47 48 112 113 114 115 116 117 118 49\r\nc=IN IP4 0.0.0.0\r\na=rtcp:9 IN IP4 0.0.0.0\r\na=ice-ufrag:TWj9\r\na=ice-pwd:/WiBDckOdsu7XkyEbhA6CF1/\r\na=ice-options:trickle\r\na=fingerprint:sha-256 17:9C:19:6C:32:3C:EA:5B:CD:57:41:D7:7D:26:42:97:6D:88:A4:AA:C3:10:76:F2:29:83:A8:C8:BD:9A:9C:2B\r\na=setup:actpass\r\na=mid:0\r\na=extmap:1 urn:ietf:params:rtp-hdrext:toffset\r\na=extmap:2 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time\r\na=extmap:3 urn:3gpp:video-orientation\r\na=extmap:4 http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01\r\na=extmap:5 http://www.webrtc.org/experiments/rtp-hdrext/playout-delay\r\na=extmap:6 http://www.webrtc.org/experiments/rtp-hdrext/video-content-type\r\na=extmap:7 http://www.webrtc.org/experiments/rtp-hdrext/video-timing\r\na=extmap:8 http://www.webrtc.org/experiments/rtp-hdrext/color-space\r\na=extmap:9 urn:ietf:params:rtp-hdrext:sdes:mid\r\na=extmap:10 urn:ietf:params:rtp-hdrext:sdes:rtp-stream-id\r\na=extmap:11 urn:ietf:params:rtp-hdrext:sdes:repaired-rtp-stream-id\r\na=recvonly\r\na=rtcp-mux\r\na=rtcp-rsize\r\na=rtpmap:96 VP8/90000\r\na=rtcp-fb:96 goog-remb\r\na=rtcp-fb:96 transport-cc\r\na=rtcp-fb:96 ccm fir\r\na=rtcp-fb:96 nack\r\na=rtcp-fb:96 nack pli\r\na=rtpmap:97 rtx/90000\r\na=fmtp:97 apt=96\r\na=rtpmap:98 VP9/90000\r\na=rtcp-fb:98 goog-remb\r\na=rtcp-fb:98 transport-cc\r\na=rtcp-fb:98 ccm fir\r\na=rtcp-fb:98 nack\r\na=rtcp-fb:98 nack pli\r\na=fmtp:98 profile-id=0\r\na=rtpmap:99 rtx/90000\r\na=fmtp:99 apt=98\r\na=rtpmap:100 VP9/90000\r\na=rtcp-fb:100 goog-remb\r\na=rtcp-fb:100 transport-cc\r\na=rtcp-fb:100 ccm fir\r\na=rtcp-fb:100 nack\r\na=rtcp-fb:100 nack pli\r\na=fmtp:100 profile-id=2\r\na=rtpmap:101 rtx/90000\r\na=fmtp:101 apt=100\r\na=rtpmap:35 VP9/90000\r\na=rtcp-fb:35 goog-remb\r\na=rtcp-fb:35 transport-cc\r\na=rtcp-fb:35 ccm fir\r\na=rtcp-fb:35 nack\r\na=rtcp-fb:35 nack pli\r\na=fmtp:35 profile-id=1\r\na=rtpmap:36 rtx/90000\r\na=fmtp:36 apt=35\r\na=rtpmap:37 VP9/90000\r\na=rtcp-fb:37 goog-remb\r\na=rtcp-fb:37 transport-cc\r\na=rtcp-fb:37 ccm fir\r\na=rtcp-fb:37 nack\r\na=rtcp-fb:37 nack pli\r\na=fmtp:37 profile-id=3\r\na=rtpmap:38 rtx/90000\r\na=fmtp:38 apt=37\r\na=rtpmap:102 H264/90000\r\na=rtcp-fb:102 goog-remb\r\na=rtcp-fb:102 transport-cc\r\na=rtcp-fb:102 ccm fir\r\na=rtcp-fb:102 nack\r\na=rtcp-fb:102 nack pli\r\na=fmtp:102 level-asymmetry-allowed=1;packetization-mode=1;profile-level-id=42001f\r\na=rtpmap:103 rtx/90000\r\na=fmtp:103 apt=102\r\na=rtpmap:104 H264/90000\r\na=rtcp-fb:104 goog-remb\r\na=rtcp-fb:104 transport-cc\r\na=rtcp-fb:104 ccm fir\r\na=rtcp-fb:104 nack\r\na=rtcp-fb:104 nack pli\r\na=fmtp:104 level-asymmetry-allowed=1;packetization-mode=0;profile-level-id=42001f\r\na=rtpmap:105 rtx/90000\r\na=fmtp:105 apt=104\r\na=rtpmap:106 H264/90000\r\na=rtcp-fb:106 goog-remb\r\na=rtcp-fb:106 transport-cc\r\na=rtcp-fb:106 ccm fir\r\na=rtcp-fb:106 nack\r\na=rtcp-fb:106 nack pli\r\na=fmtp:106 level-asymmetry-allowed=1;packetization-mode=1;profile-level-id=42e01f\r\na=rtpmap:107 rtx/90000\r\na=fmtp:107 apt=106\r\na=rtpmap:108 H264/90000\r\na=rtcp-fb:108 goog-remb\r\na=rtcp-fb:108 transport-cc\r\na=rtcp-fb:108 ccm fir\r\na=rtcp-fb:108 nack\r\na=rtcp-fb:108 nack pli\r\na=fmtp:108 level-asymmetry-allowed=1;packetization-mode=0;profile-level-id=42e01f\r\na=rtpmap:109 rtx/90000\r\na=fmtp:109 apt=108\r\na=rtpmap:127 H264/90000\r\na=rtcp-fb:127 goog-remb\r\na=rtcp-fb:127 transport-cc\r\na=rtcp-fb:127 ccm fir\r\na=rtcp-fb:127 nack\r\na=rtcp-fb:127 nack pli\r\na=fmtp:127 level-asymmetry-allowed=1;packetization-mode=1;profile-level-id=4d001f\r\na=rtpmap:125 rtx/90000\r\na=fmtp:125 apt=127\r\na=rtpmap:39 H264/90000\r\na=rtcp-fb:39 goog-remb\r\na=rtcp-fb:39 transport-cc\r\na=rtcp-fb:39 ccm fir\r\na=rtcp-fb:39 nack\r\na=rtcp-fb:39 nack pli\r\na=fmtp:39 level-asymmetry-allowed=1;packetization-mode=0;profile-level-id=4d001f\r\na=rtpmap:40 rtx/90000\r\na=fmtp:40 apt=39\r\na=rtpmap:41 H264/90000\r\na=rtcp-fb:41 goog-remb\r\na=rtcp-fb:41 transport-cc\r\na=rtcp-fb:41 ccm fir\r\na=rtcp-fb:41 nack\r\na=rtcp-fb:41 nack pli\r\na=fmtp:41 level-asymmetry-allowed=1;packetization-mode=1;profile-level-id=f4001f\r\na=rtpmap:42 rtx/90000\r\na=fmtp:42 apt=41\r\na=rtpmap:43 H264/90000\r\na=rtcp-fb:43 goog-remb\r\na=rtcp-fb:43 transport-cc\r\na=rtcp-fb:43 ccm fir\r\na=rtcp-fb:43 nack\r\na=rtcp-fb:43 nack pli\r\na=fmtp:43 level-asymmetry-allowed=1;packetization-mode=0;profile-level-id=f4001f\r\na=rtpmap:44 rtx/90000\r\na=fmtp:44 apt=43\r\na=rtpmap:45 AV1/90000\r\na=rtcp-fb:45 goog-remb\r\na=rtcp-fb:45 transport-cc\r\na=rtcp-fb:45 ccm fir\r\na=rtcp-fb:45 nack\r\na=rtcp-fb:45 nack pli\r\na=fmtp:45 level-idx=5;profile=0;tier=0\r\na=rtpmap:46 rtx/90000\r\na=fmtp:46 apt=45\r\na=rtpmap:47 AV1/90000\r\na=rtcp-fb:47 goog-remb\r\na=rtcp-fb:47 transport-cc\r\na=rtcp-fb:47 ccm fir\r\na=rtcp-fb:47 nack\r\na=rtcp-fb:47 nack pli\r\na=fmtp:47 level-idx=5;profile=1;tier=0\r\na=rtpmap:48 rtx/90000\r\na=fmtp:48 apt=47\r\na=rtpmap:112 H264/90000\r\na=rtcp-fb:112 goog-remb\r\na=rtcp-fb:112 transport-cc\r\na=rtcp-fb:112 ccm fir\r\na=rtcp-fb:112 nack\r\na=rtcp-fb:112 nack pli\r\na=fmtp:112 level-asymmetry-allowed=1;packetization-mode=0;profile-level-id=64001f\r\na=rtpmap:113 rtx/90000\r\na=fmtp:113 apt=112\r\na=rtpmap:114 H264/90000\r\na=rtcp-fb:114 goog-remb\r\na=rtcp-fb:114 transport-cc\r\na=rtcp-fb:114 ccm fir\r\na=rtcp-fb:114 nack\r\na=rtcp-fb:114 nack pli\r\na=fmtp:114 level-asymmetry-allowed=1;packetization-mode=1;profile-level-id=64001f\r\na=rtpmap:115 rtx/90000\r\na=fmtp:115 apt=114\r\na=rtpmap:116 red/90000\r\na=rtpmap:117 rtx/90000\r\na=fmtp:117 apt=116\r\na=rtpmap:118 ulpfec/90000\r\na=rtpmap:49 flexfec-03/90000\r\na=rtcp-fb:49 goog-remb\r\na=rtcp-fb:49 transport-cc\r\na=fmtp:49 repair-window=10000000\r\nm=audio 9 UDP/TLS/RTP/SAVPF 111 63 9 0 8 13 110 126\r\nc=IN IP4 0.0.0.0\r\na=rtcp:9 IN IP4 0.0.0.0\r\na=ice-ufrag:TWj9\r\na=ice-pwd:/WiBDckOdsu7XkyEbhA6CF1/\r\na=ice-options:trickle\r\na=fingerprint:sha-256 17:9C:19:6C:32:3C:EA:5B:CD:57:41:D7:7D:26:42:97:6D:88:A4:AA:C3:10:76:F2:29:83:A8:C8:BD:9A:9C:2B\r\na=setup:actpass\r\na=mid:1\r\na=extmap:14 urn:ietf:params:rtp-hdrext:ssrc-audio-level\r\na=extmap:2 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time\r\na=extmap:4 http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01\r\na=extmap:9 urn:ietf:params:rtp-hdrext:sdes:mid\r\na=recvonly\r\na=rtcp-mux\r\na=rtpmap:111 opus/48000/2\r\na=rtcp-fb:111 transport-cc\r\na=fmtp:111 minptime=10;useinbandfec=1\r\na=rtpmap:63 red/48000/2\r\na=fmtp:63 111/111\r\na=rtpmap:9 G722/8000\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:13 CN/8000\r\na=rtpmap:110 telephone-event/48000\r\na=rtpmap:126 telephone-event/8000\r\n
Aug 23 13:57:54 Schrodinger srs[1648214]: [2025-08-23 13:57:54.860][INFO][1648214][a1284p61] RTC local answer: v=0\r\no=SRS/5.0.224(Bee) 89953795364992 2 IN IP4 0.0.0.0\r\ns=SRSPlaySession\r\nt=0 0\r\na=ice-lite\r\na=group:BUNDLE 0 1\r\na=msid-semantic: WMS __defaultApp__/vasya\r\nm=video 9 UDP/TLS/RTP/SAVPF 106 116\r\nc=IN IP4 0.0.0.0\r\na=ice-ufrag:m47s2687\r\na=ice-pwd:6424qot055290ekw4rphlf890756cir2\r\na=fingerprint:sha-256 B4:A4:EB:A9:22:ED:22:7C:E2:EA:32:7B:07:1D:98:61:91:5F:69:DE:34:82:17:FC:05:BF:04:56:87:3E:FE:7F\r\na=setup:passive\r\na=mid:0\r\na=extmap:4 http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01\r\na=sendonly\r\na=rtcp-mux\r\na=rtcp-rsize\r\na=rtpmap:106 H264/90000\r\na=rtcp-fb:106 transport-cc\r\na=rtcp-fb:106 nack\r\na=rtcp-fb:106 nack pli\r\na=fmtp:106 level-asymmetry-allowed=1;packetization-mode=1;profile-level-id=42e01f\r\na=rtpmap:116 red/90000\r\na=ssrc:3763829295 cname:m67s7eah709m6565\r\na=ssrc:3763829295 msid:- fcc39589-a3e0-49f6-8729-7d0a9c14235a\r\na=ssrc:3763829295 mslabel:-\r\na=ssrc:3763829295 label:fcc39589-a3e0-49f6-8729-7d0a9c14235a\r\na=candidate:0 1 udp 2130706431 x.x.x.x 8000 typ host generation 0\r\nm=audio 9 UDP/TLS/RTP/SAVPF 63 111\r\nc=IN IP4 0.0.0.0\r\na=ice-ufrag:m47s2687\r\na=ice-pwd:6424qot055290ekw4rphlf890756cir2\r\na=fingerprint:sha-256 B4:A4:EB:A9:22:ED:22:7C:E2:EA:32:7B:07:1D:98:61:91:5F:69:DE:34:82:17:FC:05:BF:04:56:87:3E:FE:7F\r\na=setup:passive\r\na=mid:1\r\na=extmap:4 http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01\r\na=sendonly\r\na=rtcp-mux\r\na=rtcp-rsize\r\na=rtpmap:63 red/48000/2\r\na=rtpmap:111 opus/48000/2\r\na=rtcp-fb:111 transport-cc\r\na=fmtp:111 minptime=10;useinbandfec=1\r\na=ssrc:3763829296 cname:m67s7eah709m6565\r\na=ssrc:3763829296 msid:- 5cf02341-c6e9-4b8d-a6a4-47be4c5fad88\r\na=ssrc:3763829296 mslabel:-\r\na=ssrc:3763829296 label:5cf02341-c6e9-4b8d-a6a4-47be4c5fad88\r\na=candidate:0 1 udp 2130706431 x.x.x.x 8000 typ host generation 0\r\n
Aug 23 13:57:54 Schrodinger srs[1648214]: [2025-08-23 13:57:54.900][INFO][1648214][a1284p61] RTC: session address init 79.139.146.241:1810
Aug 23 13:57:55 Schrodinger srs[1648214]: [2025-08-23 13:57:55.319][INFO][1648214][a1284p61] RTC: Subscriber url=/__defaultApp__/vasya established
Aug 23 13:57:55 Schrodinger srs[1648214]: [2025-08-23 13:57:55.319][INFO][1648214][a1284p61] create consumer, no gop cache
Aug 23 13:57:55 Schrodinger srs[1648214]: [2025-08-23 13:57:55.319][INFO][1648214][a1284p61] RTC: start play url=/__defaultApp__/vasya, source_id=0qbxm0qf/pr18hq6b, realtime=1, mw_msgs=0
Aug 23 13:59:14 Schrodinger srs[1648214]: [2025-08-23 13:59:14.539][WARN][1648214][a1284p61][11] empty nalu
Aug 23 14:02:58 Schrodinger srs[1648214]: [2025-08-23 14:02:58.932][INFO][1648214][a1284p61] NACK: update seq=3015, nack range [3015, 3022]
Aug 23 14:02:58 Schrodinger srs[1648214]: [2025-08-23 14:02:58.932][WARN][1648214][a1284p61][11] drop old ts=1693103427, header=22383, lost=22385, set new ts=1693091907, header=22378, lost=22379
Aug 23 14:03:27 Schrodinger srs[1648214]: [2025-08-23 14:03:27.003][WARN][1648214][a1284p61][11] empty nalu
Aug 23 14:03:33 Schrodinger srs[1648214]: [2025-08-23 14:03:33.502][WARN][1648214][a1284p61][11] drop old ts=1696369257, header=23832, lost=23848, set new ts=1696375017, header=23849, lost=23850
Aug 23 14:03:33 Schrodinger srs[1648214]: [2025-08-23 14:03:33.502][INFO][1648214][a1284p61] NACK: update seq=23849, nack range [23848, 23849]
Aug 23 14:03:33 Schrodinger srs[1648214]: [2025-08-23 14:03:33.503][WARN][1648214][a1284p61][11] drop old ts=1696375017, header=23849, lost=23850, set new ts=1696369257, header=23848, lost=23849
Aug 23 14:03:33 Schrodinger srs[1648214]: [2025-08-23 14:03:33.503][WARN][1648214][a1284p61][11] drop old ts=1696369257, header=23848, lost=23849, set new ts=1696375017, header=23850, lost=23851
Aug 23 14:03:44 Schrodinger srs[1648214]: [2025-08-23 14:03:44.758][INFO][1648214][a1284p61] NACK: update seq=12177, nack range [12176, 12177]
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0] =================================================================
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0] ==1648214==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000000d8 (pc 0x57683baa4403 bp 0x78bc0dfb5680 sp 0x78bc0dfb5670 T1)
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0] ==1648214==The signal is caused by a READ memory access.
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0] ==1648214==Hint: address points to the zero page.
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #0 0x57683baa4403 in SrsRtpPacket::get_avsync_time() const src/kernel/srs_kernel_rtc_rtp.hpp:339, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #1 0x57683ba96391 in SrsRtmpFromRtcBridge::packet_video_rtmp(unsigned short, unsigned short) src/app/srs_app_rtc_source.cpp:1733, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #2 0x57683ba93498 in SrsRtmpFromRtcBridge::packet_video(SrsRtpPacket*) src/app/srs_app_rtc_source.cpp:1524, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #3 0x57683ba91c14 in SrsRtmpFromRtcBridge::on_rtp(SrsRtpPacket*) src/app/srs_app_rtc_source.cpp:1420, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #4 0x57683ba881a6 in SrsRtcSource::on_rtp(SrsRtpPacket*) src/app/srs_app_rtc_source.cpp:639, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #5 0x57683baa0ee8 in SrsRtcVideoRecvTrack::on_rtp(SrsRtcSource*, SrsRtpPacket*) src/app/srs_app_rtc_source.cpp:2645, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #6 0x57683b9dd88b in SrsRtcPublishStream::do_on_rtp_plaintext(SrsRtpPacket*&, SrsBuffer*) src/app/srs_app_rtc_conn.cpp:1436, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #7 0x57683b9dd2a4 in SrsRtcPublishStream::on_rtp_plaintext(char*, int) src/app/srs_app_rtc_conn.cpp:1404, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #8 0x57683b9e6884 in SrsRtcConnection::on_rtp_plaintext(char*, int) src/app/srs_app_rtc_conn.cpp:2178, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #9 0x57683ba5cba2 in SrsRtcUdpNetwork::on_rtp(char*, int) src/app/srs_app_rtc_network.cpp:281, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #10 0x57683ba7554d in SrsRtcServer::on_udp_packet(SrsUdpMuxSocket*) src/app/srs_app_rtc_server.cpp:437, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #11 0x57683b927cb2 in SrsUdpMuxListener::cycle() src/app/srs_app_listener.cpp:733, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #12 0x57683b74eaf8 in SrsFastCoroutine::cycle() src/app/srs_app_st.cpp:285, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #13 0x57683b74ec43 in SrsFastCoroutine::pfn(void*) src/app/srs_app_st.cpp:300, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #14 0x57683bad9315 in _st_thread_main /root/srs/trunk/objs/Platform-SRS5-Linux-6.11.0-GCC13.3.0-x86_64/st-srs/sched.c:380, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #15 0x57683bad9c4a in st_thread_create /root/srs/trunk/objs/Platform-SRS5-Linux-6.11.0-GCC13.3.0-x86_64/st-srs/sched.c:666, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #16 0x57683b74d65a in SrsFastCoroutine::SrsFastCoroutine(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, ISrsCoroutineHandler*, _SrsContextId) src/app/srs_app_st.cpp:145, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0]     #17 0x78bc0b7fe78f  (<unknown module>), r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0] AddressSanitizer can not provide additional info.
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0] SUMMARY: AddressSanitizer: SEGV src/kernel/srs_kernel_rtc_rtp.hpp:339 in SrsRtpPacket::get_avsync_time() const
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.309][ERROR][1648214][a1284p61][0] Thread T1 created by T0 here:
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.569][ERROR][1648214][a1284p61][0]     #0 0x57683b3799b5 in __interceptor_pthread_create (/usr/local/srs/objs/srs+0x3c99b5) (BuildId: 08ce6b25b1d7e505e6a03b0bdef895cbfa13fb0f), 0x00000
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.569][ERROR][1648214][a1284p61][0]     #1 0x57683b991860 in SrsThreadPool::execute(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, SrsCplxError* (*)(void*), void*) src/app/srs_app_threads.cpp:679, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.569][ERROR][1648214][a1284p61][0]     #2 0x57683bad7af1 in run_in_thread_pool() src/main/srs_main_server.cpp:475, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.569][ERROR][1648214][a1284p61][0]     #3 0x57683bad752b in run_directly_or_daemon() src/main/srs_main_server.cpp:414, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.569][ERROR][1648214][a1284p61][0]     #4 0x57683bad4cb5 in do_main(int, char**, char**) src/main/srs_main_server.cpp:242, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.569][ERROR][1648214][a1284p61][0]     #5 0x57683bad4fcf in main src/main/srs_main_server.cpp:253, r0=1093
Aug 23 14:04:01 Schrodinger srs[1648214]: [2025-08-23 14:04:01.824][ERROR][1648214][a1284p61][0]     #6 0x78bc0e82a1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f), 0x00000
Aug 23 14:04:02 Schrodinger srs[1648214]: [2025-08-23 14:04:02.067][ERROR][1648214][a1284p61][0]     #7 0x78bc0e82a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f), 0x00000
Aug 23 14:04:02 Schrodinger srs[1648214]: [2025-08-23 14:04:02.319][ERROR][1648214][a1284p61][0]     #8 0x57683b356774 in _start (/usr/local/srs/objs/srs+0x3a6774) (BuildId: 08ce6b25b1d7e505e6a03b0bdef895cbfa13fb0f), 0x00000
suzp1984 commented

Cause

The SRS transcode rtp packets, whose sequence number in range [start, end], to one rtmp packet, but when the first rtp packet is empty, then this crash happens.

I check the 5.0release branch, srs already did a lot of the empty check in packet_video_rtmp, but missing this one.

  1. do empty check during the rtp packet payload check.

    srs/trunk/src/app/srs_app_rtc_source.cpp

    Lines 1670 to 1676 in 27b5d15

    for (uint16_t i = 0; i < (uint16_t)cnt; ++i) {
    uint16_t sn = start + i;
    uint16_t index = cache_index(sn);
    SrsRtpPacket* pkt = cache_video_pkts_[index].pkt;
    // fix crash when pkt->payload() if pkt is nullptr;
    if (!pkt) continue;

  2. missing the first rtp packet empty check, and that's the cause of this crash

    srs/trunk/src/app/srs_app_rtc_source.cpp

    Lines 1732 to 1733 in 27b5d15

    SrsRtpPacket* pkt = cache_video_pkts_[cache_index(start)].pkt;
    rtmp.header.initialize_video(nb_payload, pkt->get_avsync_time(), 1);

  3. continue do the empty check during write the payload to rtmp.

    srs/trunk/src/app/srs_app_rtc_source.cpp

    Lines 1749 to 1754 in 27b5d15

    for (uint16_t i = 0; i < (uint16_t)cnt; ++i) {
    uint16_t index = cache_index((start + i));
    SrsRtpPacket* pkt = cache_video_pkts_[index].pkt;
    // fix crash when pkt->payload() if pkt is nullptr;
    if (!pkt) continue;

I checked the develop branch (or 7.0), the SRS already fixed it. Because develop (7.0) doing huge refactoring, cherry-pick those patch to 6.0release or 5.0 release branch may not an easy job, I would suggest you to use develop branch if you don't care the stable or not in production env.

And I'll try to send a 6.0release based patch to resolve this bug, and suggest you to switch to 6.0 release, because 5.0release may no longer accept patches.