[Asterisk-bsd] Segfault when using Milliwatt

[Gil Kloepfer]

I just upgraded to 1.2.0 on FreeBSD, and get a segfault when
running the Milliwatt application from a SIP phone.

So far this seems to only be with SIP devices (an IAX call
from another PBX to the same extension with Milliwatt worked
fine).

The backtrace indicates milliwatt_generate() is
being called with a ridiculous frame length value.
Going through the code to find where this comes from,
I end up all the way back into the RTP/SIP code, and from
there I can't make heads or tails of any of it.

Is anyone else seeing this bug?  Do you see it on any other
platform (I don't have my test setup on Debian available
right now).  I don't know if it's a portability bug, a
bug I introduced by something I did, or a bug in core
Asterisk.

Thanks!

[begin backtrace]
     -- Executing Answer("SIP/204-6259", "") in new stack
     -- Executing Milliwatt("SIP/204-6259", "") in new stack
 
 Program received signal SIGSEGV, Segmentation fault.
 [Switching to Thread 14 (LWP 100159)]
 0x08061cbc in ast_write (chan=0x8143000, fr=0x8e250080) at channel.c:2277
 2277    channel.c: No such file or directory.
         in channel.c
 (gdb) bt
 #0  0x08061cbc in ast_write (chan=0x8143000, fr=0x8e250080) at channel.c:2277
 #1  0x285f0fa8 in milliwatt_generate (chan=0x81430cc, data=0x86c7450, 
     len=-1082279552, samples=134620855) at app_milliwatt.c:102
 #2  0x080626b7 in ast_read (chan=0x8143000) at channel.c:1968
 #3  0x437f6b36 in ?? ()
 #4  0x00030e08 in ?? ()
 #5  0x437f6b36 in ?? ()
 #6  0x000343de in ?? ()
 #7  0x081430cc in ?? ()
[...]
[end backtrace]

---
Gil Kloepfer
astr-bsd at kloepfer.org