[asterisk-bugs] [Asterisk 0011612]: Repeatedly calling Page with a LOCAL channel crashes asterisk

[noreply at bugs.digium.com]

The following issue has been RESOLVED. 
====================================================================== 
http://bugs.digium.com/view.php?id=11612 
====================================================================== 
Reported By:                dtyoo
Assigned To:                putnopvut
====================================================================== 
Project:                    Asterisk
Issue ID:                   11612
Category:                   Applications/app_page
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     resolved
Asterisk Version:           1.4.15  
SVN Branch (only for SVN checkouts, not tarball releases): N/A  
SVN Revision (number only!):  
Disclaimer on File?:        N/A 
Request Review:              
Resolution:                 fixed
Fixed in Version:           
====================================================================== 
Date Submitted:             12-20-2007 13:41 CST
Last Modified:              12-21-2007 10:57 CST
====================================================================== 
Summary:                    Repeatedly calling Page with a LOCAL channel crashes
asterisk
Description: 
We recently had a situation where we had a dialplan programming error that
caused an infinite loop.  Placing a call into this piece of dialplan logic
re-producibly crashes asterisk.  While the dialplan logic is certainly in
error, I thought that someone could get something out of looking at these
backtraces.  It looks like there is some sort of memory corruption going on
that ultimately takes down asterisk.

The dialplan that causes the problem looks like this:

[page-crash]
exten => s,1,Set(TIMEOUT(absolute)=60)
exten => s,2,Page(LOCAL/1234 at tpn-dev,,)

[tpn-dev]
exten => 1234,1,Goto(page-crash,s,1)


Calling 1234 at tpn-dev triggers the loop which ultimately crashes asterisk. 
I don't expect good things to happen with a dialplan like this, but I'm
wondering if this scenario is exposing an underlying memory problem
somewhere.  I will upload backtrace info as well.

====================================================================== 

---------------------------------------------------------------------- 
 putnopvut - 12-21-07 10:57  
---------------------------------------------------------------------- 
The issue here was that list elements were being freed during a traversal
of the list. I have fixed this in revision 94468 of 1.4 and in revision
94477 of trunk. Thanks for your help in getting this solved. 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
12-21-07 10:57  putnopvut      Status                   feedback => resolved
12-21-07 10:57  putnopvut      Resolution               open => fixed       
12-21-07 10:57  putnopvut      Assigned To               => putnopvut       
12-21-07 10:57  putnopvut      Note Added: 0075804                          
======================================================================