[Home]

Summary:ASTERISK-10802: Crash with IAX2 incoming call: Bad magic number
Reporter:csaigne (csaigne)Labels:
Date Opened:2007-11-19 02:01:57.000-0600Date Closed:2007-12-04 19:56:47.000-0600
Priority:CriticalRegression?No
Status:Closed/CompleteComponents:Channels/chan_iax2
Versions:Frequency of
Occurrence
Related
Issues:
Environment:Attachments:
Description:I' running Asterisk on MacMini G4 with OSX 10.5.1.
It works very well with version 1.4.10
But since versions using astobj2.c file I have an error Bad magic number when I receive a IAX call and Asterik quit.

I just test it with Asterisk 1.4.14 and it is the same.

Here is the function in astobj2.c wich get the error:

/*!
* \brief convert from a pointer _p to a user-defined object
*
* \return the pointer to the astobj2 structure
*/
static inline struct astobj2 *INTERNAL_OBJ(void *user_data)
{
struct astobj2 *p;

if (!user_data) {
ast_log(LOG_ERROR, "user_data is NULL\n");
return NULL;
}

p = (struct astobj2 *) ((char *) user_data - sizeof(*p));
if (AO2_MAGIC != (p->priv_data.magic) ) {
ast_log(LOG_ERROR, "bad magic number 0x%x for %p\n", p->priv_data.magic, p);
p = NULL;
}

return p;
}

#####################################################

My iax.conf:

[general]

bandwidth=high

disallow=all
allow=alaw
alow=ulaw
allow=gsm

jitterbuffer=no
forcejitterbuffer=no

autokill=yes

[####]
type=friend
username=####
context=fromiax

[voiptalk]
type=peer
username=####
secret=####
host=iax5.voiptalk.org
Comments:By: Digium Subversion (svnbot) 2007-12-04 18:32:47.000-0600

Repository: asterisk
Revision: 91070

U   branches/1.4/include/asterisk/lock.h

------------------------------------------------------------------------
r91070 | russell | 2007-12-04 18:32:46 -0600 (Tue, 04 Dec 2007) | 11 lines

Fix some crashes in chan_iax2 that were reported as happening on Mac systems.
It turns out that the problem was the Mac version of the ast_atomic_fetchadd_int()
function.  The Mac atomic add function returns the _new_ value, while this function
is supposed to return the old value.  So, the crashes happened on unreferencing
objects.  If the reference count was decreased to 1, ao2_ref() thought that it
had been decreased to zero, and called the destructor.  However, there was still
an outstanding reference around.

(closes issue ASTERISK-10701)
(closes issue ASTERISK-10802)

------------------------------------------------------------------------
By: Digium Subversion (svnbot) 2007-12-04 19:56:47.000-0600

Repository: asterisk
Revision: 91114

_U  trunk/
U   trunk/include/asterisk/lock.h

------------------------------------------------------------------------
r91114 | russell | 2007-12-04 19:56:46 -0600 (Tue, 04 Dec 2007) | 19 lines

Merged revisions 91070 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r91070 | russell | 2007-12-04 18:35:31 -0600 (Tue, 04 Dec 2007) | 11 lines

Fix some crashes in chan_iax2 that were reported as happening on Mac systems.
It turns out that the problem was the Mac version of the ast_atomic_fetchadd_int()
function.  The Mac atomic add function returns the _new_ value, while this function
is supposed to return the old value.  So, the crashes happened on unreferencing
objects.  If the reference count was decreased to 1, ao2_ref() thought that it
had been decreased to zero, and called the destructor.  However, there was still
an outstanding reference around.

(closes issue ASTERISK-10701)
(closes issue ASTERISK-10802)

........

------------------------------------------------------------------------