Summary:ASTERISK-09409: Crash when call parking after attended transfer
Reporter:ten-forward (ten-forward)Labels:
Date Opened:2007-05-09 07:29:44Date Closed:2007-06-19 14:23:39
Versions:Frequency of
Environment:Attachments:( 0) conf.tgz
Description:1. [User A] call to [User B]
2. [User B] attended transfer to [User C]
3. [User B] disconnect (, connect between [User A] and [User C]
4. [User A] park call
5. Crash asterisk

All users use SIP.

#0  0xb7e1bf04 in raise () from /lib/libc.so.6
#1  0xb7e1d5fb in abort () from /lib/libc.so.6
#2  0xb7e4dfa0 in __libc_message () from /lib/libc.so.6
#3  0xb7e5370b in malloc_printerr () from /lib/libc.so.6
#4  0xb7e54114 in free () from /lib/libc.so.6
ASTERISK-1  0x0806160f in ast_channel_free (chan=0x8186590) at channel.c:957
ASTERISK-2  0x08067a3d in ast_hangup (chan=0x8186590) at channel.c:1390
ASTERISK-3  0xb7c29a34 in do_parking_thread (ignore=0x0) at res_features.c:1610
ASTERISK-4  0xb7fbf1ef in start_thread () from /lib/libpthread.so.0
ASTERISK-5  0xb7ea990e in clone () from /lib/libc.so.6
Comments:By: Joshua C. Colp (jcolp) 2007-05-09 12:17:54

How are you doing the transfers? DTMF based or from the SIP devices themselves?

By: ten-forward (ten-forward) 2007-05-09 21:17:50

DTMF based

By: Joshua C. Colp (jcolp) 2007-05-14 11:20:02

I tried to reproduce this issue under the latest 1.2 from subversion but was unable to. Do you have the console output from when it happened? Any other information?

By: ten-forward (ten-forward) 2007-05-15 01:54:56

I tried latest 1.2 and reproduce this. I upload file used for this test (sip.conf, extensions.conf, features.conf).

Reproduction procedure is as follows:
1. user 203 calls 201
2. 201 attended transfer to 202 (push "#2 202")
3. 201 disconnect (connect 202, 203)
4. 203 call park (push "#1 700")
5. crash asterisk

Console output is as follows:
May 15 15:39:07 WARNING[20069]: channel.c:901 ast_channel_free: Unable to find channel in list
*** glibc detected *** double free or corruption (!prev): 0x0819f2b0 ***

Thank you.

By: Russell Bryant (russell) 2007-06-19 14:23:38

This crash should no longer occur in the latest code.  However, if you still have a problem, feel free to reopen this bug.  Thanks!