[asterisk-bugs] [Asterisk 0016013]: [patch] crash in ast_frame_free / ast_generic_bridge

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=16013 
====================================================================== 
Reported By:                atis
Assigned To:                tilghman
====================================================================== 
Project:                    Asterisk
Issue ID:                   16013
Category:                   Core/General
Reproducibility:            random
Severity:                   crash
Priority:                   normal
Status:                     ready for testing
Asterisk Version:           SVN 
JIRA:                       SWP-312 
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): 1.6.1 
SVN Revision (number only!): 221969 
Request Review:              
====================================================================== 
Date Submitted:             2009-10-02 12:35 CDT
Last Modified:              2009-11-06 07:38 CST
====================================================================== 
Summary:                    [patch] crash in ast_frame_free / ast_generic_bridge
Description: 
I have this crash sometimes on 1.6.1 branch

# 0  0x00000000004abe46 in ast_frame_free (frame=0x323931203a6d6f72,
cache=1) at frame.c:379
# 1  0x000000000046600c in ast_generic_bridge (c0=0x2aaaac272818,
c1=0x2aaad4079fb8, config=0x44065120, fo=0x44064278, rc=0x44064270,
bridge_end={tv_sec = 0, tv_usec = 0}) at channel.c:4855
# 2  0x0000000000467e2e in ast_channel_bridge (c0=0x2aaaac272818,
c1=0x2aaad4079fb8, config=0x44065120, fo=0x44064278, rc=0x44064270) at
channel.c:5187
# 3  0x000000000049d00a in ast_bridge_call (chan=0x2aaaac272818,
peer=0x2aaad4079fb8, config=0x44065120) at features.c:2540
# 4  0x00002aaab333b026 in dial_exec_full (chan=0x2aaaac272818,
data=0x44067890, peerflags=0x44065680, continue_exec=0x0) at
app_dial.c:1986
# 5  0x00002aaab333b863 in dial_exec (chan=0x2aaaac272818,
data=0x44067890) at app_dial.c:2060

====================================================================== 

---------------------------------------------------------------------- 
 (0113274) atis (reporter) - 2009-11-06 07:38
 https://issues.asterisk.org/view.php?id=16013#c113274 
---------------------------------------------------------------------- 
Attached crash while using r228147 + 20091105__issue16013.diff.txt

(gdb) p *frame
Cannot access memory at address 0x756d2f656d6f682f

(gdb) frame 1
# 1  0x0000000000460cdf in ast_write (chan=0x2aaac8133b68, fr=0x23b97f0)
at channel.c:3582
3582                    ast_frfree(f);
(gdb) p *f
$1 = {frametype = AST_FRAME_DTMF_END, subclass = 0, datalen = 0, samples =
0, mallocd = -670184184, mallocd_hdr_len = 0, offset = -559038737, src =
0xc0 <Address 0xc0 out of bounds>, data = {ptr = 0xc4, uint32 = 196, pad =
"?\000\000\000\000\000\000"}, delivery = {tv_sec = 46913257589472, tv_usec
= 32}, frame_list = {next = 0x756d2f656d6f682f}, flags = 1630496370, ts =
3329899763270906729, len = 7002937344469577521, seqno = 1700754547} 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-11-06 07:38 atis           Note Added: 0113274                          
======================================================================