[Home]

Summary:ASTERISK-11538: pickup launched with null option will crash asterisk
Reporter:Joao Carvalho (foxfire)Labels:
Date Opened:2008-02-28 11:49:13.000-0600Date Closed:2008-02-28 13:17:34.000-0600
Priority:MinorRegression?No
Status:Closed/CompleteComponents:Applications/General
Versions:Frequency of
Occurrence
Related
Issues:
Environment:Attachments:( 0) 12100-nullappargs.diff
Description:this is a minor issue, but should not be simple to fix.
Our asterisk server is connected via qsig to an Alcatel 4400.
One of our VoiP users tried to pickup an Alcatel extension. Of because there
was no extension my AGI tried to invoke pickup without any parameters. The
result was in an asterisk crash with core dumped.
I fixed this problem in my AGI so it will not happen again, just letting you know
of the problem.
I am adding the two lines of my log that matter, i can also upload the coredump if necessary.


****** ADDITIONAL INFORMATION ******

/var/log/asterisk
-----
[Feb 28 17:26:13] VERBOSE[4100] logger.c:     -- AGI Script Executing Application: (pickup) Options: ((null))
-----
/var/log/syslog
-----
Feb 28 17:26:13 voip kernel: asterisk[4100]: segfault at 00000000 eip b7e9c093 esp b59c579c error 4
-----
Comments:By: Jason Parker (jparker) 2008-02-28 12:04:21.000-0600

I'm not able to reproduce this.  Can you give the exact line you're using to call Pickup()?

   -- Executing [6018@default:1] Pickup("SIP/5555-00820010", "") in new stack
[Feb 28 12:06:24] WARNING[20542]: app_directed_pickup.c:142 pickup_exec: Pickup requires an argument (extension)!
 == Spawn extension (default, 6018, 1) exited non-zero on 'SIP/5555-00820010'
By: Jason Parker (jparker) 2008-02-28 12:22:29.000-0600

I see why it's happening now, and I've uploaded a patch.  Could you give that a try?

Apparently AGI handles application arguments differently than dialplan.  This should fix this specific instance of the problem, as well as any other (AGI or otherwise).
By: Digium Subversion (svnbot) 2008-02-28 13:16:27.000-0600

Repository: asterisk
Revision: 105005

U   branches/1.4/main/cdr.c
U   branches/1.4/main/pbx.c

------------------------------------------------------------------------
r105005 | qwell | 2008-02-28 13:16:26 -0600 (Thu, 28 Feb 2008) | 9 lines

Make pbx_exec pass an empty string into applications, if we get NULL.
This protects against possible segfaults in applications that may try
to use data before checking length (ast_strdupa'ing it, for example)

(closes issue ASTERISK-11538)
Reported by: foxfire
Patches:
     12100-nullappargs.diff uploaded by qwell (license 4)

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=105005
By: Digium Subversion (svnbot) 2008-02-28 13:17:34.000-0600

Repository: asterisk
Revision: 105006

_U  trunk/
U   trunk/main/cdr.c
U   trunk/main/pbx.c

------------------------------------------------------------------------
r105006 | qwell | 2008-02-28 13:17:32 -0600 (Thu, 28 Feb 2008) | 17 lines

Merged revisions 105005 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r105005 | qwell | 2008-02-28 13:20:10 -0600 (Thu, 28 Feb 2008) | 9 lines

Make pbx_exec pass an empty string into applications, if we get NULL.
This protects against possible segfaults in applications that may try
to use data before checking length (ast_strdupa'ing it, for example)

(closes issue ASTERISK-11538)
Reported by: foxfire
Patches:
     12100-nullappargs.diff uploaded by qwell (license 4)

........

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=105006