[Home]

Summary:ASTERISK-15037: ChanSpy crashes Asterisk
Reporter:wetwired (wetwired)Labels:
Date Opened:2009-10-26 13:07:19Date Closed:2009-11-10 15:45:06.000-0600
Priority:CriticalRegression?No
Status:Closed/CompleteComponents:Applications/app_chanspy
Versions:Frequency of
Occurrence
Related
Issues:
Environment:Attachments:( 0) gdb.txt
Description:After updating to latest SVN version (225581) of branch 1.4 ChanSpy application crashes Asterisk.

****** ADDITIONAL INFORMATION ******

   -- Executing [777@outgoing:1] ChanSpy("SIP/162-08decc98", "SIP|wb") in new stack
   -- <SIP/162-08decc98> Playing 'beep' (language 'en')
   -- <SIP/162-08decc98> Playing 'spy-sip' (language 'en')
   -- <SIP/162-08decc98> Playing 'digits/1' (language 'en')
   -- <SIP/162-08decc98> Playing 'digits/1' (language 'en')
   -- <SIP/162-08decc98> Playing 'digits/2' (language 'en')
 == Spying on channel SIP/112-08dfaa60
[Oct 26 22:48:20] NOTICE[23860]: app_chanspy.c:218 start_spying: Attaching SIP/162-08decc98 to SIP/112-08dfaa60
[Oct 26 22:48:20] NOTICE[23860]: app_chanspy.c:218 start_spying: Attaching SIP/162-08decc98 to SIP/112-08dfaa60
localhost*CLI> *** glibc detected *** /usr/sbin/asterisk: double free or corruption (!prev): 0x08df9948 ***
======= Backtrace: =========
/lib/libc.so.6[0x92a0f1]
/lib/libc.so.6(cfree+0x90)[0x92dbc0]
/usr/sbin/asterisk[0x80a4845]
/usr/sbin/asterisk(ast_frame_free+0x23)[0x80a48a7]
/usr/sbin/asterisk(ast_write+0xd54)[0x8084fd5]
/usr/lib/asterisk/modules/res_musiconhold.so[0x37c21c]
/usr/sbin/asterisk[0x8081de4]
/usr/sbin/asterisk[0x80836c2]
/usr/sbin/asterisk(ast_read+0x19)[0x808394a]
/usr/sbin/asterisk[0x8088dd7]
/usr/sbin/asterisk(ast_channel_bridge+0x1097)[0x808a394]
/usr/lib/asterisk/modules/res_features.so(ast_bridge_call+0xa9d)[0x5ba97b]
/usr/lib/asterisk/modules/app_dial.so[0xddfcef]
/usr/lib/asterisk/modules/app_dial.so[0xddff0a]
/usr/sbin/asterisk(pbx_exec+0xcb)[0x80beb30]
/usr/sbin/asterisk[0x80c1fc1]
/usr/sbin/asterisk(ast_spawn_extension+0x45)[0x80c2f2f]
/usr/sbin/asterisk[0x80c3337]
/usr/sbin/asterisk[0x80c4244]
/usr/sbin/asterisk[0x8103962]
/lib/libpthread.so.0[0xa1249b]
/lib/libc.so.6(clone+0x5e)[0x99242e]
Comments:By: wetwired (wetwired) 2009-10-27 00:13:15

This only happens when we use ChanSpy in "whisper mode". Without "w" option everything works fine.
By: Digium Subversion (svnbot) 2009-11-06 16:39:04.000-0600

Repository: asterisk
Revision: 228692

U   branches/1.4/main/channel.c

------------------------------------------------------------------------
r228692 | dvossel | 2009-11-06 16:39:04 -0600 (Fri, 06 Nov 2009) | 9 lines

fixes audiohook write crash occuring in chan_spy whisper mode.

After writing to the audiohook list in ast_write(), frames
were being freed incorrectly.  Under certain conditions this
resulted in a double free crash.

(closes issue ASTERISK-15037)
Reported by: wetwired

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=228692
By: Digium Subversion (svnbot) 2009-11-06 16:41:21.000-0600

Repository: asterisk
Revision: 228693

_U  trunk/
U   trunk/main/channel.c

------------------------------------------------------------------------
r228693 | dvossel | 2009-11-06 16:41:21 -0600 (Fri, 06 Nov 2009) | 16 lines

Merged revisions 228692 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
 r228692 | dvossel | 2009-11-06 16:33:27 -0600 (Fri, 06 Nov 2009) | 9 lines
 
 fixes audiohook write crash occuring in chan_spy whisper mode.
 
 After writing to the audiohook list in ast_write(), frames
 were being freed incorrectly.  Under certain conditions this
 resulted in a double free crash.
 
 (closes issue ASTERISK-15037)
 Reported by: wetwired
........

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=228693
By: Digium Subversion (svnbot) 2009-11-06 16:42:43.000-0600

Repository: asterisk
Revision: 228694

_U  branches/1.6.2/
U   branches/1.6.2/main/channel.c

------------------------------------------------------------------------
r228694 | dvossel | 2009-11-06 16:42:42 -0600 (Fri, 06 Nov 2009) | 23 lines

Merged revisions 228693 via svnmerge from
https://origsvn.digium.com/svn/asterisk/trunk

................
 r228693 | dvossel | 2009-11-06 16:35:44 -0600 (Fri, 06 Nov 2009) | 16 lines
 
 Merged revisions 228692 via svnmerge from
 https://origsvn.digium.com/svn/asterisk/branches/1.4
 
 ........
   r228692 | dvossel | 2009-11-06 16:33:27 -0600 (Fri, 06 Nov 2009) | 9 lines
   
   fixes audiohook write crash occuring in chan_spy whisper mode.
   
   After writing to the audiohook list in ast_write(), frames
   were being freed incorrectly.  Under certain conditions this
   resulted in a double free crash.
   
   (closes issue ASTERISK-15037)
   Reported by: wetwired
 ........
................

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=228694
By: Digium Subversion (svnbot) 2009-11-06 16:43:12.000-0600

Repository: asterisk
Revision: 228695

_U  branches/1.6.1/
U   branches/1.6.1/main/channel.c

------------------------------------------------------------------------
r228695 | dvossel | 2009-11-06 16:43:12 -0600 (Fri, 06 Nov 2009) | 23 lines

Merged revisions 228693 via svnmerge from
https://origsvn.digium.com/svn/asterisk/trunk

................
 r228693 | dvossel | 2009-11-06 16:35:44 -0600 (Fri, 06 Nov 2009) | 16 lines
 
 Merged revisions 228692 via svnmerge from
 https://origsvn.digium.com/svn/asterisk/branches/1.4
 
 ........
   r228692 | dvossel | 2009-11-06 16:33:27 -0600 (Fri, 06 Nov 2009) | 9 lines
   
   fixes audiohook write crash occuring in chan_spy whisper mode.
   
   After writing to the audiohook list in ast_write(), frames
   were being freed incorrectly.  Under certain conditions this
   resulted in a double free crash.
   
   (closes issue ASTERISK-15037)
   Reported by: wetwired
 ........
................

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=228695
By: Digium Subversion (svnbot) 2009-11-06 16:43:42.000-0600

Repository: asterisk
Revision: 228696

_U  branches/1.6.0/
U   branches/1.6.0/main/channel.c

------------------------------------------------------------------------
r228696 | dvossel | 2009-11-06 16:43:42 -0600 (Fri, 06 Nov 2009) | 23 lines

Merged revisions 228693 via svnmerge from
https://origsvn.digium.com/svn/asterisk/trunk

................
 r228693 | dvossel | 2009-11-06 16:35:44 -0600 (Fri, 06 Nov 2009) | 16 lines
 
 Merged revisions 228692 via svnmerge from
 https://origsvn.digium.com/svn/asterisk/branches/1.4
 
 ........
   r228692 | dvossel | 2009-11-06 16:33:27 -0600 (Fri, 06 Nov 2009) | 9 lines
   
   fixes audiohook write crash occuring in chan_spy whisper mode.
   
   After writing to the audiohook list in ast_write(), frames
   were being freed incorrectly.  Under certain conditions this
   resulted in a double free crash.
   
   (closes issue ASTERISK-15037)
   Reported by: wetwired
 ........
................

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=228696
By: Digium Subversion (svnbot) 2009-11-09 10:39:44.000-0600

Repository: asterisk
Revision: 228692

U   branches/1.4/main/channel.c

------------------------------------------------------------------------
r228692 | dvossel | 2009-11-06 16:33:27 -0600 (Fri, 06 Nov 2009) | 15 lines

fixes audiohook write crash occuring in chan_spy whisper mode.

After writing to the audiohook list in ast_write(), frames
were being freed incorrectly.  Under certain conditions this
resulted in a double free crash.

(closes issue ASTERISK-15037)
Reported by: wetwired

(closes issue ASTERISK-14963)
Reported by: bluecrow76
Patches:
     issue16045.diff uploaded by dvossel (license 671)
Tested by: bluecrow76, dvossel, habile

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=228692
By: Digium Subversion (svnbot) 2009-11-09 11:08:56.000-0600

Repository: asterisk
Revision: 228693

_U  trunk/
U   trunk/main/channel.c

------------------------------------------------------------------------
r228693 | dvossel | 2009-11-06 16:35:44 -0600 (Fri, 06 Nov 2009) | 22 lines

Merged revisions 228692 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
 r228692 | dvossel | 2009-11-06 16:33:27 -0600 (Fri, 06 Nov 2009) | 9 lines
 
 fixes audiohook write crash occuring in chan_spy whisper mode.
 
 After writing to the audiohook list in ast_write(), frames
 were being freed incorrectly.  Under certain conditions this
 resulted in a double free crash.
 
 (closes issue ASTERISK-15037)
 Reported by: wetwired

 (closes issue ASTERISK-14963)
 Reported by: bluecrow76
 Patches:
       issue16045.diff uploaded by dvossel (license 671)
 Tested by: bluecrow76, dvossel, habile
........

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=228693