[Home]

Summary:ASTERISK-15414: crash: in "scheduled_destroy" at chan_iax2.c:1511
Reporter:Jens von Bülow (jensvb)Labels:
Date Opened:2010-01-07 11:30:18.000-0600Date Closed:2010-01-07 14:22:51.000-0600
Priority:CriticalRegression?No
Status:Closed/CompleteComponents:Channels/chan_iax2
Versions:Frequency of
Occurrence
Related
Issues:
Environment:Attachments:( 0) core.5709.txt
Description:Greetings,

I experienced an asterisk crash today. Full backtrace attached.

Why would callno be negative?

<snip>
#2  0x00002aaac611437a in scheduled_destroy (vid=0x8000) at chan_iax2.c:1511
       callno = -32768
       __PRETTY_FUNCTION__ = "scheduled_destroy"
</snip>

I would appreciate any help or pointers with this issue.

Regards
Jens


****** ADDITIONAL INFORMATION ******

<snip>
(gdb) bt full
#0  0x0000003811808ac0 in pthread_mutex_lock () from /lib64/libpthread.so.0
No symbol table info available.
#1  0x00002aaac61125a9 in ast_mutex_lock (pmutex=0x2aaac6262f40) at /root/_ast1428/asterisk-1.4.28/include/asterisk/lock.h:759
No locals.
#2  0x00002aaac611437a in scheduled_destroy (vid=0x8000) at chan_iax2.c:1511
       callno = -32768
       __PRETTY_FUNCTION__ = "scheduled_destroy"
#3  0x00000000004ba76b in ast_sched_runq (con=0x2868f00) at sched.c:363
       current = (struct sched *) 0x2aab2001e780
       tv = {tv_sec = 1262874381, tv_usec = 179493}
       numevents = 0
       res = 10922
#4  0x00002aaac61418d7 in sched_thread (ignore=0x0) at chan_iax2.c:10490
       ms = 53
       count = 0
       ts = {tv_sec = 1262874381, tv_nsec = 176391000}
       __PRETTY_FUNCTION__ = "sched_thread"
ASTERISK-1  0x00000000004cb7a9 in dummy_start (data=0x28763e0) at utils.c:856
       __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {0, -142742561192117192, 0, 1109811200, 0, 4096, -142742561192116872, -142742560086254984},
     __mask_was_saved = 0}}, __pad = {0x422651d0, 0x0, 0x0, 0x0}}
       __cancel_routine = (void (*)(void *)) 0x4243c4 <ast_unregister_thread>
       __cancel_arg = (void *) 0x42265940
       not_first_call = 0
       ret = (void *) 0x0
       a = {start_routine = 0x2aaac61417d1 <sched_thread>, data = 0x0,
 name = 0x2876400 "sched_thread         started at [10590] chan_iax2.c start_network_thread()"}
ASTERISK-2  0x0000003811806617 in start_thread () from /lib64/libpthread.so.0
No symbol table info available.
ASTERISK-3  0x00000038110d3c2d in clone () from /lib64/libc.so.6
No symbol table info available.
(gdb)
</snip>
Comments:By: Digium Subversion (svnbot) 2010-01-07 14:14:26.000-0600

Repository: asterisk
Revision: 238411

U   branches/1.4/channels/chan_iax2.c

------------------------------------------------------------------------
r238411 | dvossel | 2010-01-07 14:14:25 -0600 (Thu, 07 Jan 2010) | 10 lines

fixes crash in "scheduled_destroy" in chan_iax

A signed short was used to represent a callnumber.  This is makes
it possible to attempt to access the iaxs array with a negative
index.

(closes issue ASTERISK-15414)
Reported by: jensvb


------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=238411
By: Digium Subversion (svnbot) 2010-01-07 14:15:28.000-0600

Repository: asterisk
Revision: 238412

_U  trunk/
U   trunk/channels/chan_iax2.c

------------------------------------------------------------------------
r238412 | dvossel | 2010-01-07 14:15:28 -0600 (Thu, 07 Jan 2010) | 16 lines

Merged revisions 238411 via svnmerge from
https://origsvn.digium.com/svn/asterisk/branches/1.4

........
 r238411 | dvossel | 2010-01-07 14:14:25 -0600 (Thu, 07 Jan 2010) | 10 lines
 
 fixes crash in "scheduled_destroy" in chan_iax
 
 A signed short was used to represent a callnumber.  This is makes
 it possible to attempt to access the iaxs array with a negative
 index.
 
 (closes issue ASTERISK-15414)
 Reported by: jensvb
........

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=238412
By: Digium Subversion (svnbot) 2010-01-07 14:17:49.000-0600

Repository: asterisk
Revision: 238416

_U  branches/1.6.2/
U   branches/1.6.2/channels/chan_iax2.c

------------------------------------------------------------------------
r238416 | dvossel | 2010-01-07 14:17:49 -0600 (Thu, 07 Jan 2010) | 23 lines

Merged revisions 238412 via svnmerge from
https://origsvn.digium.com/svn/asterisk/trunk

................
 r238412 | dvossel | 2010-01-07 14:15:27 -0600 (Thu, 07 Jan 2010) | 16 lines
 
 Merged revisions 238411 via svnmerge from
 https://origsvn.digium.com/svn/asterisk/branches/1.4
 
 ........
   r238411 | dvossel | 2010-01-07 14:14:25 -0600 (Thu, 07 Jan 2010) | 10 lines
   
   fixes crash in "scheduled_destroy" in chan_iax
   
   A signed short was used to represent a callnumber.  This is makes
   it possible to attempt to access the iaxs array with a negative
   index.
   
   (closes issue ASTERISK-15414)
   Reported by: jensvb
 ........
................

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=238416
By: Digium Subversion (svnbot) 2010-01-07 14:20:39.000-0600

Repository: asterisk
Revision: 238430

_U  branches/1.6.1/
U   branches/1.6.1/channels/chan_iax2.c

------------------------------------------------------------------------
r238430 | dvossel | 2010-01-07 14:20:38 -0600 (Thu, 07 Jan 2010) | 23 lines

Merged revisions 238412 via svnmerge from
https://origsvn.digium.com/svn/asterisk/trunk

................
 r238412 | dvossel | 2010-01-07 14:15:27 -0600 (Thu, 07 Jan 2010) | 16 lines
 
 Merged revisions 238411 via svnmerge from
 https://origsvn.digium.com/svn/asterisk/branches/1.4
 
 ........
   r238411 | dvossel | 2010-01-07 14:14:25 -0600 (Thu, 07 Jan 2010) | 10 lines
   
   fixes crash in "scheduled_destroy" in chan_iax
   
   A signed short was used to represent a callnumber.  This is makes
   it possible to attempt to access the iaxs array with a negative
   index.
   
   (closes issue ASTERISK-15414)
   Reported by: jensvb
 ........
................

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=238430
By: Digium Subversion (svnbot) 2010-01-07 14:22:51.000-0600

Repository: asterisk
Revision: 238441

_U  branches/1.6.0/
U   branches/1.6.0/channels/chan_iax2.c

------------------------------------------------------------------------
r238441 | dvossel | 2010-01-07 14:22:50 -0600 (Thu, 07 Jan 2010) | 23 lines

Merged revisions 238412 via svnmerge from
https://origsvn.digium.com/svn/asterisk/trunk

................
 r238412 | dvossel | 2010-01-07 14:15:27 -0600 (Thu, 07 Jan 2010) | 16 lines
 
 Merged revisions 238411 via svnmerge from
 https://origsvn.digium.com/svn/asterisk/branches/1.4
 
 ........
   r238411 | dvossel | 2010-01-07 14:14:25 -0600 (Thu, 07 Jan 2010) | 10 lines
   
   fixes crash in "scheduled_destroy" in chan_iax
   
   A signed short was used to represent a callnumber.  This is makes
   it possible to attempt to access the iaxs array with a negative
   index.
   
   (closes issue ASTERISK-15414)
   Reported by: jensvb
 ........
................

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=238441