[Asterisk-bugs] [Asterisk 0010171]: Asterisk crashes on GROUP_COUNT with a category

[noreply at bugs.digium.com]

The following issue has been RESOLVED. 
====================================================================== 
http://bugs.digium.com/view.php?id=10171 
====================================================================== 
Reported By:                mlegas
Assigned To:                file
====================================================================== 
Project:                    Asterisk
Issue ID:                   10171
Category:                   Functions/func_groupcount
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     resolved
Asterisk Version:           1.4.6 
SVN Branch (only for SVN checkouts, not tarball releases): N/A  
SVN Revision (number only!):  
Disclaimer on File?:        No 
Request Review:              
Resolution:                 fixed
Fixed in Version:           
====================================================================== 
Date Submitted:             07-10-2007 09:14 CDT
Last Modified:              07-10-2007 09:35 CDT
====================================================================== 
Summary:                    Asterisk crashes on GROUP_COUNT with a category
Description: 
Asterisk 1.4.6 running on a Linux Debian Sarge kernel 2.4

A calls B and sets a GROUP with name A with no category
while on call, A receives a call through a macro that tries to execute
GROUP_COUNT(A at mycategory) 
ast_app_group_get_count tries to search a corresponding group and category
within the list and then crashes because it finds a corresponding group but
the category is empty and the string comparison causes a crash
here:
   if (!strcasecmp(gi->group, group) && (ast_strlen_zero(category) ||
!strcasecmp(gi->category, category)))

gi->category is NULL in that case 


from the core dump:
http://bugs.digium.com/view.php?id=0  0x402217df in strcasecmp () from
/lib/libc.so.6
(gdb) bt
http://bugs.digium.com/view.php?id=0  0x402217df in strcasecmp () from
/lib/libc.so.6
http://bugs.digium.com/view.php?id=1  0x0805f3eb in ast_app_group_get_count
(group=0xbd7ece64 "0178164006",
category=0xbd7ece14 "qmember") at strings.h:34
http://bugs.digium.com/view.php?id=62 0x080b9d9d in
pbx_substitute_variables_helper_full (c=0x8218c08,
headp=0xbd7edefc, cp1=0xbd7edf08 "0178164006 at qmember", cp2=0xbd7ecefc "",
    count=4096) at pbx.c:1105
http://bugs.digium.com/view.php?id=63 0x080b9d9d in
pbx_substitute_variables_helper_full (c=0x8218c08,
headp=0x8218f4c, cp1=0xbd7f0f7c "${GROUP_COUNT(${ARG1}@qmember)}=0",
    cp2=0xbd7eff7c "", count=4095) at pbx.c:1105
http://bugs.digium.com/view.php?id=64 0x080ba1fa in
pbx_substitute_variables_helper_full (c=0x8218c08,
headp=0x8218f4c,
    cp1=0x8200110 "$[${GROUP_COUNT(${ARG1}@qmember)}=0]?dial:NOANSWER",
cp2=0xbd7f61a4 "", count=8191) at pbx.c:1720
http://bugs.digium.com/view.php?id=65 0x080ba317 in
pbx_substitute_variables_helper (c=0x402c1b60,
cp1=0xbd7ffd90 "`\033,@`\025,@\234?\177?",
    cp2=0xbd7ffd90 "`\033,@`\025,@\234?\177?", count=-1115685488) at
pbx.c:1741
http://bugs.digium.com/view.php?id=66 0x080c2a3c in pbx_extension_helper
(c=0x8218c08, con=0xbd7ffd90,
context=0x8218d88 "macro-stdext-qmember", exten=0x8218dd8 "s", priority=2,
    label=0x0, callerid=0x40b95920 "anonymous", action=136416264) at
pbx.c:1805
http://bugs.digium.com/view.php?id=67 0x080c0c72 in ast_spawn_extension
(c=0xbd7ffd90, context=0xbd7ffd90
"`\033,@`\025,@\234?\177?", exten=0xbd7ffd90 "`\033,@`\025,@\234?\177?",
    priority=-1115685488, callerid=0xbd7ffd90 "`\033,@`\025,@\234?\177?")
at pbx.c:2288
http://bugs.digium.com/view.php?id=68 0x40c0b440 in macroif_exec
(chan=0x8218c08, data=0x8218c08) at
app_macro.c:344
http://bugs.digium.com/view.php?id=69 0x40c0a95e in macro_exec (chan=0x8218c08,
data=0x40b67f20) at
app_macro.c:209
http://bugs.digium.com/view.php?id=70 0x080c2af2 in pbx_extension_helper
(c=0x8218c08, con=0xbd7ffd90,
context=0x8218d88 "macro-stdext-qmember", exten=0x8218dd8 "s", priority=1,
    label=0x0, callerid=0x40b95920 "anonymous", action=136416264) at
pbx.c:532
http://bugs.digium.com/view.php?id=71 0x080c3731 in __ast_pbx_run (c=0x8218c08)
at pbx.c:2288
http://bugs.digium.com/view.php?id=72 0x080c45d1 in pbx_thread (data=0xbd7ffd90)
at pbx.c:2601
http://bugs.digium.com/view.php?id=73 0x080f2e99 in dummy_start
(data=0x402c1b60) at utils.c:545
http://bugs.digium.com/view.php?id=74 0x40027e51 in pthread_start_thread () from
/lib/libpthread.so.0
http://bugs.digium.com/view.php?id=75 0x402818aa in clone () from /lib/libc.so.6


====================================================================== 

Issue History 
Date Modified   Username       Field                    Change               
====================================================================== 
07-10-07 09:35  file           Status                   new => resolved     
07-10-07 09:35  file           Resolution               open => fixed       
07-10-07 09:35  file           Assigned To               => file            
======================================================================