[asterisk-bugs] [Asterisk 0014478]: Blind transfer to parking from SIP phone crashes Asterisk

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=14478 
====================================================================== 
Reported By:                erik_dedecker
Assigned To:                jpeeler
====================================================================== 
Project:                    Asterisk
Issue ID:                   14478
Category:                   Features/Parking
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     feedback
Asterisk Version:           1.6.0.5 
Regression:                 No 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2009-02-14 06:22 CST
Last Modified:              2009-02-22 05:48 CST
====================================================================== 
Summary:                    Blind transfer to parking from SIP phone crashes
Asterisk
Description: 
ested with SIP phone Thomson ST2030 firmware V1.66 (and others)

After a BLIND transfer to a parking lot, using the phone transfer button,
the ST2030 hangsup the call ( channel status is AST_CAUSE_NORMAL_CLEARING
16)

Two issues arise : 

1. the saydigits application (ast_say_digits line 502 in features.c)
announcing the parking lot, tries to acces a hangup channel and crashes
Asterisk.

2. If this line is commented to avoid the issue, chan_sip.c tries to free
the allocated channel structures ( ast_free(d->req.data)lines 15901 150903
in chan_sip.c) and crashes Asterisk with a glibc free() error.

Before making any suggestions on how to correct the issue I would like to
have your advise on how avoid the crash by testing the channel status
before calling ast_say_digits and ast_free(d->req.data)

Testing d->chan2->hangupcause and not calling free() may not be the
solution because the channel still hangs arround. You can check this at the
CLI with core show channels. At a stop now it will eventually clear but its
not nice to have zombies hanging around !

Thanks in advance  

Erik


====================================================================== 

---------------------------------------------------------------------- 
 (0100516) erik_dedecker (reporter) - 2009-02-22 05:48
 http://bugs.digium.com/view.php?id=14478#c100516 
---------------------------------------------------------------------- 
Asterisk 1.6.1 revision 177624 behaves correctly with respect to the
reported bug.
(asterisk does not crash anymore)

We noticed however that the call does not return to the originating
parker: the call is dropped after a failed dial. I suggest that this is
issue is opened as seperate bug and look at it when I have time.

Pulsar*CLI>
    -- Added extension 'SIP02031' priority 1 to park-dial (0x8278860)
  == Timeout for SIP/2030-0828ccd0 parked on 51 (default). Returning to
park-dial,SIP02031,1
    -- Executing [SIP02031 at park-dial:1] Dial("SIP/2030-0828ccd0",
"SIP/2031|30|TWtw") in new stack
  == Using SIP RTP CoS mark 5
  == Everyone is busy/congested at this time (1:0/0/1)
    -- Auto fallthrough, channel 'SIP/2030-0828ccd0' status is
'CHANUNAVAIL' 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-02-22 05:48 erik_dedecker  Note Added: 0100516                          
======================================================================