[asterisk-bugs] [Asterisk 0011612]: Repeatedly calling Page with a LOCAL channel crashes asterisk

[noreply at bugs.digium.com]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=11612 
====================================================================== 
Reported By:                dtyoo
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   11612
Category:                   Applications/app_page
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     feedback
Asterisk Version:           1.4.15  
SVN Branch (only for SVN checkouts, not tarball releases): N/A  
SVN Revision (number only!):  
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             12-20-2007 13:41 CST
Last Modified:              12-20-2007 22:09 CST
====================================================================== 
Summary:                    Repeatedly calling Page with a LOCAL channel crashes
asterisk
Description: 
We recently had a situation where we had a dialplan programming error that
caused an infinite loop.  Placing a call into this piece of dialplan logic
re-producibly crashes asterisk.  While the dialplan logic is certainly in
error, I thought that someone could get something out of looking at these
backtraces.  It looks like there is some sort of memory corruption going on
that ultimately takes down asterisk.

The dialplan that causes the problem looks like this:

[page-crash]
exten => s,1,Set(TIMEOUT(absolute)=60)
exten => s,2,Page(LOCAL/1234 at tpn-dev,,)

[tpn-dev]
exten => 1234,1,Goto(page-crash,s,1)


Calling 1234 at tpn-dev triggers the loop which ultimately crashes asterisk. 
I don't expect good things to happen with a dialplan like this, but I'm
wondering if this scenario is exposing an underlying memory problem
somewhere.  I will upload backtrace info as well.

====================================================================== 

---------------------------------------------------------------------- 
 dtyoo - 12-20-07 22:09  
---------------------------------------------------------------------- 
Corydon76-

With MALLOC_DEBUG enabled I get different results under the same scenario.
 Without running under valgrind, asterisk still crashes, but it seems to
take longer to do so, and the bt looks different even though there is still
corruption.  I've uploaded it so you can see.

Under valgrind asterisk doesn't crash, it hangs.  After an initial burst
of looping activity, the console is just full of messages "chan_iax2.c:6699
socket_read: Out of idle IAX2 threads for I/O, pausing!" over and over. 
Asterisk isn't taking any calls at this point.  valgrind.txt shows a
problem similar to the original bt I posted.

One other thing worth mentioning is that we run "ulimit -n 63536" before
starting asterisk on our servers.  It seems that this is required in order
for the problem to happen.  If I leave this at the default (1024) I cannot
reproduce the issue. 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
12-20-07 22:09  dtyoo          Note Added: 0075781                          
======================================================================