[Home]

Summary:ASTERISK-00806: Asterisk crash when call from SIP to Skinny
Reporter:alex4152 (alex4152)Labels:
Date Opened:2004-01-12 11:37:48.000-0600Date Closed:2004-09-25 02:52:16
Priority:CriticalRegression?No
Status:Closed/CompleteComponents:Core/General
Versions:Frequency of
Occurrence
Related
Issues:
Environment:Attachments:( 0) skinny.txt
Description:1) Asterisk crash when call from sip to skinny.
2) Asterisk crash when skinny call own number.

****** ADDITIONAL INFORMATION ******

1) crash when phoneset is up  (on hook) at first or second attempt.

It look like a bug
http://bugs.digium.com/bug_view_page.php?bug_id=0000563
I am using Asterisk CVS-01/11/04-00:00:30.
additional info attached
Comments:By: jrollyson (jrollyson) 2004-01-12 11:53:35.000-0600

bt full?
By: alex4152 (alex4152) 2004-01-12 12:05:15.000-0600

...

Loaded symbols for /lib/libnsl.so.1
#0  0x0807ba4d in ast_rtp_set_peer (rtp=0x0, them=0xb237fa00) at rtp.c:774
774             rtp->them.sin_port = them->sin_port;
(gdb)
(gdb)
(gdb)
(gdb)

(gdb)
(gdb)
(gdb)
(gdb)
(gdb)
(gdb)
(gdb) bt
#0  0x0807ba4d in ast_rtp_set_peer (rtp=0x0, them=0xb237fa00) at rtp.c:774
#1  0x00c7e8ac in handle_message (req=0x9621100, s=0x961c150) at chan_skinny.c:2192
#2  0x00c7ca5c in skinny_session (data=0x961c150) at chan_skinny.c:2318
#3  0x00b7679c in start_thread () from /lib/tls/libpthread.so.0
#4  0x00ad627a in clone () from /lib/tls/libc.so.6
(gdb)
By: alex4152 (alex4152) 2004-01-12 12:11:22.000-0600

(gdb) bt full
#0  0x0807ba4d in ast_rtp_set_peer (rtp=0x0, them=0xb237fa00) at rtp.c:774
No locals.
#1  0x00c7e8ac in handle_message (req=0x9621100, s=0x961c150) at chan_skinny.c:2192
       c = (struct ast_channel *) 0x95f0d50
       f = {frametype = 0, subclass = 0, datalen = 0, samples = 0, mallocd = 0, offset = 0, src = 0x0, data = 0x0, prev = 0x0, next = 0x0}
       sin = {sin_family = 2, sin_port = 62039, sin_addr = {s_addr = 371290580}, sin_zero = "\001\000\000\000(&ASTERISK-1041;7&ASTERISK-9290;"}
       us = {sin_family = 4344, sin_port = 2402, sin_addr = {s_addr = 8}, sin_zero = "&ASTERISK-1053;\003\000\000\000\023&ASTERISK-1019;"}
       lines = (struct skinny_line *) 0x95f0d50
       name = "H\023&ASTERISK-1019;\000\000\023&ASTERISK-1019;\000\000\023&ASTERISK-1019;\000`\b\000"
       d = 0 '\0'
       digit = -1304954368
       lineNumber = -1304954368
       stimulus = 62039
       port = 0
       i = 0
       timer = 11736320
       cmtime = (struct tm *) 0x0
       t = 2147483785
       sub = (struct skinny_subchannel *) 0xb237fa00
       sub = (struct skinny_subchannel *) 0x0
       sub = (struct skinny_subchannel *) 0x95f0d50
#2  0x00c7ca5c in skinny_session (data=0x961c150) at chan_skinny.c:2318
       res = 0
       req = (skinny_req *) 0x0
#3  0x00b7679c in start_thread () from /lib/tls/libpthread.so.0
No symbol table info available.
#4  0x00ad627a in clone () from /lib/tls/libc.so.6
No symbol table info available.
By: ww (ww) 2004-01-12 12:13:36.000-0600

suggest some parameter checking in the routines in rtp.c
to make sure they don't dereference null pointers. this will
prevent the crash, but doesn't address why they got passed
null pointers to begin with.
By: Olle Johansson (oej) 2004-03-21 08:39:21.000-0600

Still an open case?
By: Mark Spencer (markster) 2004-04-02 16:30:35.000-0600

Can you please provide me with an updated backtrace.  Chan_skinny seems to have been updated.
By: Mark Spencer (markster) 2004-04-05 23:51:37

Recent testing indicates this has already been fixed in CVS