[asterisk-bugs] [Asterisk 0014374]: Revision 172517 segfault after using A *2 transfer to B and B dial *2

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=14374 
====================================================================== 
Reported By:                aragon
Assigned To:                putnopvut
====================================================================== 
Project:                    Asterisk
Issue ID:                   14374
Category:                   Applications/app_transfer
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     ready for testing
Asterisk Version:           1.4.23 
Regression:                 No 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!): 172517 
Request Review:              
====================================================================== 
Date Submitted:             2009-01-30 13:40 CST
Last Modified:              2009-02-05 11:34 CST
====================================================================== 
Summary:                    Revision 172517 segfault after using A *2 transfer
to B and B dial *2
Description: 
SIP environment
Extension 6011 dials 6010
6010 dials *26002 and ends call to complete transfer
6002 answers and dials *2 but does receive audio for transfer prompt
Asterisk segfaults after dialing *2

Backtrace attached
====================================================================== 

---------------------------------------------------------------------- 
 (0099508) svnbot (reporter) - 2009-02-05 11:34
 http://bugs.digium.com/view.php?id=14374#c99508 
---------------------------------------------------------------------- 
Repository: asterisk
Revision: 173559

U   branches/1.4/apps/app_mixmonitor.c

------------------------------------------------------------------------
r173559 | mmichelson | 2009-02-05 11:34:33 -0600 (Thu, 05 Feb 2009) | 25
lines

Fix a problem where a channel pointer becomes invalid due to masquerading
or hanging up.

app_mixmonitor runs its own thread to monitor the channel's activity and
write the mixed
audio to a file. Since this thread runs independently of the channel, it
is possible that
the mixmonitor thread's channel pointer will point to freed memory when
the channel either
is masqueraded or hangs up (technically, both cases are hangups, but we
need to handle the
cases slightly differently).

The solution for this is to employ a datastore, which has the nice benefit
of allowing us 
to hook into channel masquerades and hangups and update our pointer as
necessary. If this
looks familiar, this same technique is employed in app_chanspy.
app_chanspy is a bit more
involved since it does a lot more operations on the channel that is being
spied upon.

app_mixmonitor does have an extra touch that app_chanspy doesn't have,
though. Since there
is a thread race between the channel's thread and the mixmonitor thread on
a hangup, we em-
ploy a condition-and-boolean combination to ensure that the channel thread
finishes with
our structure before the mixmonitor thread attempts to free it. No
crashes!

(closes issue http://bugs.digium.com/view.php?id=14374)
Reported by: aragon
Patches:
	  14374.patch uploaded by putnopvut (license 60)
Tested by: aragon, putnopvut


------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=173559 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-02-05 11:34 svnbot         Note Added: 0099508                          
======================================================================