[asterisk-bugs] [Asterisk 0013240]: Execute Playtones(Busy) from AGI and Asterisk crash

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=13240 
====================================================================== 
Reported By:                jvandal
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   13240
Category:                   Core/Channels
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     new
Asterisk Version:           1.4.21.2 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Disclaimer on File?:        N/A 
Request Review:              
====================================================================== 
Date Submitted:             2008-08-05 11:11 CDT
Last Modified:              2008-08-06 09:46 CDT
====================================================================== 
Summary:                    Execute Playtones(Busy) from AGI and Asterisk crash
Description: 
I have an AGi that execute the Playtones(busy) application and when I dial
this exten from IAX phone (Zoiper), asterisk crash.

If I dial from a SIP phone, all work as expected.
====================================================================== 

---------------------------------------------------------------------- 
 (0091142) putnopvut (administrator) - 2008-08-06 09:46
 http://bugs.digium.com/view.php?id=13240#c91142 
---------------------------------------------------------------------- 
The error handling certainly does prevent a crash, but what seems more
important is figuring out why the codec to be translated had an invalid
value in the first place. Corydon76 brings up a good point about potential
memory corruption, but what bothers me is the fact that this crash did not
occur when using a SIP phone. The backtrace does not indicate any
channel-specific functions on the stack, leading me to believe that if
stack space were the issue, the crash would occur with either a SIP or an
IAX device.

Going back to my original idea about the rawwriteformat being invalid, I
did a grep of the source and found that most channel drivers set the
channel's rawwriteformat when a new channel is created. chan_iax2 does not
do this and, in fact, never sets the rawwriteformat for a created channel.
This may actually be the source of the issue here. I will run some tests
locally since this should be easy to reproduce if this is the case. 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2008-08-06 09:46 putnopvut      Note Added: 0091142                          
======================================================================