[Home]

Summary:ASTERISK-12174: [patch] "restart gracefully" can crash asterisk
Reporter:Yuri (ys)Labels:
Date Opened:2008-06-11 08:28:46Date Closed:2008-06-17 13:19:10
Priority:MinorRegression?No
Status:Closed/CompleteComponents:Core/Configuration
Versions:Frequency of
Occurrence
Related
Issues:
Environment:Attachments:( 0) backtrace.txt
( 1) pbx.c.diff
Description:I think, that __ast_context_destroy() function in main/pbx.c contain some bug, but now can found there...

You can reproduce coredump file whith following CLI command:

*CLI> module unload app_queue.so
*CLI> restart gracefully

Comments:By: Mark Michelson (mmichelson) 2008-06-11 09:56:07

Could you upload a backtrace from the crash? I tried to reproduce this myself and could not.
By: Yuri (ys) 2008-06-16 06:09:05

backtrace added.

I think, in this line:

"if (strcmp(tmp->registrar, registrar) == 0 && tmp->refcount < 2 && !tmp->root) {"

"tmp->registrar" points to unallocated memory, but why?
By: Yuri (ys) 2008-06-17 06:31:55

Heh

patch uploaded, there I fix:

missed "!" for strcasecmp()
incomplete registrar checking for context.
By: Digium Subversion (svnbot) 2008-06-17 13:16:10

Repository: asterisk
Revision: 123358

U   trunk/main/pbx.c

------------------------------------------------------------------------
r123358 | tilghman | 2008-06-17 13:16:09 -0500 (Tue, 17 Jun 2008) | 6 lines

If we don't match registrar when destroying a context, it can cause a crash.
(closes issue ASTERISK-12174)
Reported by: ys
Patches:
      pbx.c.diff uploaded by ys (license 281)

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=123358
By: Digium Subversion (svnbot) 2008-06-17 13:19:10

Repository: asterisk
Revision: 123372

_U  branches/1.6.0/

------------------------------------------------------------------------
r123372 | tilghman | 2008-06-17 13:19:07 -0500 (Tue, 17 Jun 2008) | 13 lines

Blocked revisions 123358 via svnmerge

........
r123358 | tilghman | 2008-06-17 13:23:01 -0500 (Tue, 17 Jun 2008) | 6 lines

If we don't match registrar when destroying a context, it can cause a crash.
(closes issue ASTERISK-12174)
Reported by: ys
Patches:
      pbx.c.diff uploaded by ys (license 281)

........

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=123372