[asterisk-bugs] [Asterisk 0010508]: Segfault when answering ringing mobile while monitoring call with mixmonitor

[noreply at bugs.digium.com]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=10508 
====================================================================== 
Reported By:                phokz
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   10508
Category:                   Addons/chan_mobile
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     feedback
Asterisk Version:            SVN 
SVN Branch (only for SVN checkouts, not tarball releases):  trunk 
SVN Revision (number only!): 426 
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             08-21-2007 03:50 CDT
Last Modified:              08-22-2007 16:01 CDT
====================================================================== 
Summary:                    Segfault when answering ringing mobile while
monitoring call with mixmonitor
Description: 
When I try to answer call and playback welcome message before forwarding
to sip extension, asterisk crashes.

Note that call is monitored by mixmonitor.

Asterisk is trunk r. 80129
chan_mobile is addons trunk r. 426
System is openSUSE 10.2. Mobile is Nokia6230i.

gdb backtrace follows:


Core was generated by `asterisk -vvvc'.
Program terminated with signal 11, Segmentation fault.
http://bugs.digium.com/view.php?id=0  0x080fb4b9 in ast_slinfactory_read
(sf=0x8226178, buf=0xb62550c0,
samples=160) at slinfactory.c:134
134                                     memcpy(sf->hold, frame_data,
remain * sizeof(*offset));
(gdb) bt
http://bugs.digium.com/view.php?id=0  0x080fb4b9 in ast_slinfactory_read
(sf=0x8226178, buf=0xb62550c0,
samples=160) at slinfactory.c:134
http://bugs.digium.com/view.php?id=1  0x08073903 in audiohook_read_frame_both
(audiohook=0x8226120,
samples=160) at audiohook.c:192
http://bugs.digium.com/view.php?id=2  0x08073d08 in ast_audiohook_read_frame
(audiohook=0x8226120,
samples=160, direction=AST_AUDIOHOOK_DIRECTION_BOTH, format=64)
    at audiohook.c:256
http://bugs.digium.com/view.php?id=3  0xb651f376 in mixmonitor_thread
(obj=0x8226120) at
app_mixmonitor.c:165
http://bugs.digium.com/view.php?id=4  0x08108635 in dummy_start (data=0x8225ee0)
at utils.c:789
http://bugs.digium.com/view.php?id=5  0xb7d86112 in start_thread () from
/lib/libpthread.so.0
http://bugs.digium.com/view.php?id=6  0xb7ba12ee in clone () from /lib/libc.so.6

Without call monitoring it seems to work. This might be an issue in
asterisk itself, not chan_mobile.

====================================================================== 

---------------------------------------------------------------------- 
 phokz - 08-22-07 16:01  
---------------------------------------------------------------------- 
I tried to load asterisk in kdbg and found that for some reasons
remain variable at asterisk/main/slinfactory.c is less than zero.

I tried attached dirty hack, which adds range checking.

I do not understand the code. It isn't commented very well, and I am not a
programmer. But it seems that some combination of input variables is able
to trigger this. 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
08-22-07 16:01  phokz          Note Added: 0069279                          
======================================================================