[asterisk-bugs] [Asterisk 0013050]: Memory segmentation fault on T.38 pass through

Wed Feb 11 11:39:14 CST 2009

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=13050 
====================================================================== 
Reported By:                schern
Assigned To:                Corydon76
====================================================================== 
Project:                    Asterisk
Issue ID:                   13050
Category:                   Channels/chan_sip/T.38
Reproducibility:            always
Severity:                   block
Priority:                   normal
Status:                     feedback
Target Version:             1.4.24
Asterisk Version:           1.4.21 
Regression:                 No 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2008-07-10 08:17 CDT
Last Modified:              2009-02-11 11:39 CST
====================================================================== 
Summary:                    Memory segmentation fault on T.38 pass through
Description: 
I tried to use the chan_sip with T.38 pass through. An Fax is coming via
T.38 from
the Carrier an should go to a Linksys SPA2102 (T.38 enabled).
Short after starting UDPL traffic I got a segmentation fault.
The crash is 100% reproducible.
Outbound T.38 is no problem at all.
====================================================================== 

---------------------------------------------------------------------- 
 (0099905) schern (reporter) - 2009-02-11 11:39
 http://bugs.digium.com/view.php?id=13050#c99905 
---------------------------------------------------------------------- 
Before changing LOCAL_FAX_MAX_DATAGRAM to 1000 Asterisk crashes
independently from settings in udptl.conf (T38FaxMaxDatagram):

--- snip ---
[...]
Got UDPTL packet from 62.180.55.10:20710 (type 0, seq 0, len 21)
Got UDPTL packet from 62.180.55.10:20710 (type 0, seq 0, len 6)
Sent UDPTL packet to 212.87.38.44:59184 (type 0, seq 34, len 16)
Got UDPTL packet from 62.180.55.10:20710 (type 0, seq 0, len 6)
Got UDPTL packet from 62.180.55.10:20710 (type 0, seq 0, len 251)
Sent UDPTL packet to 212.87.38.44:59184 (type 0, seq 35, len 259)
Got UDPTL packet from 62.180.55.10:20710 (type 0, seq 0, len 251)
Sent UDPTL packet to 212.87.38.44:59184 (type 0, seq 0, len 502)

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1075951968 (LWP 20201)]
0x0000000000000000 in ?? ()
(gdb) p last_function
$1 = "udptl_debug_test_addr\000daddr", '\0' <repeats 52 times>
(gdb)
--- snap ---

After changing LOCAL_FAX_MAX_DATAGRAM to 1000 Asterisk is not crashing any
longer but the fax calls are always incomplete:

--- snip ---
[...]
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 6)
Sent UDPTL packet to 212.87.38.44:63690 (type 0, seq 78, len 16)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 6)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 191)
Sent UDPTL packet to 212.87.38.44:63690 (type 0, seq 79, len 199)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 191)
Sent UDPTL packet to 212.87.38.44:63690 (type 0, seq 80, len 382)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 191)
Sent UDPTL packet to 212.87.38.44:63690 (type 0, seq 81, len 567)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 191)
Sent UDPTL packet to 212.87.38.44:63690 (type 0, seq 82, len 752)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 191)
Sent UDPTL packet to 212.87.38.44:63690 (type 0, seq 83, len 752)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 191)
Sent UDPTL packet to 212.87.38.44:63690 (type 0, seq 84, len 752)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 191)
Sent UDPTL packet to 212.87.38.44:63690 (type 0, seq 85, len 752)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 111)
Sent UDPTL packet to 212.87.38.44:63690 (type 0, seq 86, len 672)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 6)
Sent UDPTL packet to 212.87.38.44:63690 (type 0, seq 87, len 487)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 6)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 6)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 6)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 6)
Sent UDPTL packet to 212.87.38.44:63690 (type 0, seq 88, len 302)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 6)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 6)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 6)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 191)
Sent UDPTL packet to 212.87.38.44:63690 (type 0, seq 89, len 302)
Got UDPTL packet from 62.180.55.10:21982 (type 0, seq 0, len 191)
Sent UDPTL packet to 212.87.38.44:63690 (type 0, seq 90, len 382)
  == Spawn extension (incoming, 030346499198, 3) exited non-zero on
'SIP/in-px1-008f8480'
[Thread 1075951968 (zombie) exited]
--- snap --- 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-02-11 11:39 schern         Note Added: 0099905                          
======================================================================