[asterisk-bugs] [Asterisk 0015041]: Crash on attended transfer

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
http://bugs.digium.com/view.php?id=15041 
====================================================================== 
Reported By:                maxnuv
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   15041
Category:                   General
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     feedback
Asterisk Version:           1.4.24 
Regression:                 No 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2009-05-06 04:47 CDT
Last Modified:              2009-05-08 00:02 CDT
====================================================================== 
Summary:                    Crash on attended transfer
Description: 
Call incoming, first transfer (all ok), second transfer: call, the called
respond, the trasferer hangup, SEGFAULT (before playng beep).

Two backtrace available, one old and one new.

====================================================================== 

---------------------------------------------------------------------- 
 (0104429) maxnuv (reporter) - 2009-05-08 00:02
 http://bugs.digium.com/view.php?id=15041#c104429 
---------------------------------------------------------------------- 
IMPORTANT:

This is the timeline of this call, sorry :-):

SIP/223 called my phone number
SIP/223 transferred the call at SIP/210
SIP/210 transferred back the call at SIP/223

I think the segfault is when the external call is "linked" with the new
sip call.

I found interesting this: in a normal call without segfault after the last
line of the log:

[May  6 11:21:31] VERBOSE[13766] logger.c:     -- SIP/223-082968b0
answered Local/223 at from-sip-u-d29f,2
[May  6 11:21:31] VERBOSE[13766] logger.c:   == Spawn extension
(from-sip-u, 223, 6) exited non-zero on 'Local/223 at from-sip-u-d29f,2'

continue with something like this (this is a SIMULATION of the log all
things are wrong, date numbers channels etc. etc.).

The segfault seems to be HERE

[May  7 16:35:35] VERBOSE[19244] logger.c:     -- Stopped music on hold on
WOOMERA/g3/6

Here the channel does the fixup (link the external line with the leg of
the call 223)

[May  7 16:35:35] VERBOSE[19244] logger.c:     --
<SIP/223 at from-sip-u-d29f,2> Playing 'beep' (language 'it')
[May  7 16:35:36] VERBOSE[19244] logger.c:   == Spawn extension
(from-sip-u, chiama, 2) exited non-zero on 'SIP/210-b62384e8'

So i think the segfault can be on:

The moh
The fixup 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-05-08 00:02 maxnuv         Note Added: 0104429                          
======================================================================