[asterisk-bugs] [Asterisk 0014157]: Asterisk revision 166901 segfault during park using Aastra SPRE function to park extension

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=14157 
====================================================================== 
Reported By:                aragon
Assigned To:                murf
====================================================================== 
Project:                    Asterisk
Issue ID:                   14157
Category:                   Features/Parking
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     feedback
Target Version:             1.4.24
Asterisk Version:           1.4.23-rc3 
Regression:                 No 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!): 166901 
Request Review:              
====================================================================== 
Date Submitted:             2008-12-31 16:32 CST
Last Modified:              2009-01-16 13:36 CST
====================================================================== 
Summary:                    Asterisk revision 166901 segfault during park using
Aastra SPRE function to park extension
Description: 
features.conf
parkext=700

Aastra programmable key configured as spre:700

Aastra phone answers incoming call from another SIP extension.
Aastra user presses PFK to send caller to park orbit.
Aastra phone automatically grabs line 2 key puts line 1 on hold and plays
back park extension 701 on line 2.
Asterisk segfaults
Line 1 remains on hold and blinking on Aastra phone for a short time.




Asterisk segfaults


====================================================================== 

---------------------------------------------------------------------- 
 (0098038) aragon (reporter) - 2009-01-16 13:36
 http://bugs.digium.com/view.php?id=14157#c98038 
---------------------------------------------------------------------- 
I just tested Repository: asterisk
Revision: 168716

U branches/1.4/res/res_features.c

------------------------------------------------------------------------
r168716 | twilson | 2009-01-15 12:22:50 -0600 (Thu, 15 Jan 2009) | 12
lines

Convert call to park_call_full to masq_park_call_announce

Since we removed the AST_PBX_KEEPALIVE return value, we need to use
masqueraded
parking, otherwise we will try to call ast_hangup() in __pbx_run() and in
do_parking_thread() and then promptly crash.
(closes issue 0014215)
    Reported by: waverly360
    Tested by: otherwiseguy
(closes issue 0014228)
    Reported by: kobaz
    Tested by: otherwiseguy

This resulted in segfault during SIP transfer to park ext

Core was generated by `/usr/sbin/asterisk -f -U scopserv -G scopserv -vvvg
-c'.
Program terminated with signal 11, Segmentation fault.
http://bugs.digium.com/view.php?id=0  0x0808aba9 in ast_channel_free ()
(gdb) bt
http://bugs.digium.com/view.php?id=0  0x0808aba9 in ast_channel_free ()
http://bugs.digium.com/view.php?id=1  0x0808bae2 in ast_hangup ()
http://bugs.digium.com/view.php?id=2  0x00f82212 in do_parking_thread
(ignore=0x0) at res_features.c:1994
http://bugs.digium.com/view.php?id=3  0x0811f7d7 in dummy_start ()
http://bugs.digium.com/view.php?id=4  0x008fd45b in start_thread () from
/lib/libpthread.so.0
http://bugs.digium.com/view.php?id=5  0x00854e5e in clone () from /lib/libc.so.6
(gdb) bt full
http://bugs.digium.com/view.php?id=0  0x0808aba9 in ast_channel_free ()
No symbol table info available.
http://bugs.digium.com/view.php?id=1  0x0808bae2 in ast_hangup ()
No symbol table info available.
http://bugs.digium.com/view.php?id=2  0x00f82212 in do_parking_thread
(ignore=0x0) at res_features.c:1994
        f = (struct ast_frame *) 0x0
        chan = (struct ast_channel *) 0x8d54a28
        tms = 3145
        x = 7
        con = (struct ast_context *) 0x8075704
        pl = (struct parkeduser *) 0x0
        pt = (struct parkeduser *) 0x0
        ms = -1
        nrfds = {fds_bits = {0 <repeats 32 times>}}
        pu = (struct parkeduser *) 0x8d66c68
        max = -1
        nefds = {fds_bits = {0 <repeats 32 times>}}
        rfds = {fds_bits = {0, 0, 0, 0, 1048576, 0 <repeats 27 times>}}
        efds = {fds_bits = {0 <repeats 32 times>}}
        __PRETTY_FUNCTION__ = "do_parking_thread"
http://bugs.digium.com/view.php?id=3  0x0811f7d7 in dummy_start ()
No symbol table info available.
http://bugs.digium.com/view.php?id=4  0x008fd45b in start_thread () from
/lib/libpthread.so.0
No symbol table info available.
http://bugs.digium.com/view.php?id=5  0x00854e5e in clone () from /lib/libc.so.6
No symbol table info available. 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-01-16 13:36 aragon         Note Added: 0098038                          
======================================================================