[asterisk-bugs] [Asterisk 0016070]: Seg Fault on Transfer with IAX/iLBC

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=16070 
====================================================================== 
Reported By:                Ayth
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   16070
Category:                   Channels/chan_iax2
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     new
Asterisk Version:           Older 1.4 
JIRA:                        
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2009-10-14 12:18 CDT
Last Modified:              2009-10-23 14:00 CDT
====================================================================== 
Summary:                    Seg Fault on Transfer with IAX/iLBC
Description: 
Hello,

We recently in our process of upgrading asterisk have run into serious
problems. Our environment is as follows:

Asterisk clusters spread across three countries. IAX trunking is done
between each office. Running CentOS 4.7 and Asterisk 1.4.26.

We have for the longest time used iLBC as the codec between the offices,
and wish to continue, however, we are experiencing seg faults with it. See
https://issues.asterisk.org/view.php?id=13116, as we are having the exact
same issues, but the patch in this post is already in our code.

When using jitter buffer, with iLBC and Mixmonitor we have seg faults when
a user tries to transfer the call to another party within the office. A
example call is as follows:

1. Call comes into our system in one office, and is trunked via IAX to
another office.
2. Call gets recorded using MixMonitor(with audiohook_inherit), and enters
a queue.
3. Call is answered by one of our staff. If the call is completed with
that one agent we are fine, however, if that agent needs to transfer it to
another person Asterisk seg faults and dumps it's core.

I have run gdb against the core, and am posting it here, also before
testing this I turned up SIP/IAX/Core debugging within the CLI. I've also
attached that output.

We normally use a RPM version of Asterisk that we package ourselves,
however, I'm able to reproduce this from source at will. If I remove the
option for jitterbuffer, or not record the call, or change the codec I
don't get the seg faults at all. However, we need them in place or else the
phone quality goes down the tubes.
====================================================================== 

---------------------------------------------------------------------- 
 (0112679) Ayth (reporter) - 2009-10-23 14:00
 https://issues.asterisk.org/view.php?id=16070#c112679 
---------------------------------------------------------------------- 
Ok I've found the issue, but need definite guidance. Using an idea I got
from aragon, I started working backwards. It turns out that 1.2.24 didn't
give me problems. So I started checking out revisions of 1.4 until I had
the crash and worked my way down.

This bug was introduced in revision 204012 of 1.4. Using this revision,
trunking through IAX with ILBC codec, I can crash Asterisk at will, by
performing a transfer.

Here is from the changelog:
2009-06-29 15:04 +0000 [r204012]  Mark Michelson <mmichelson at digium.com>

        * apps/app_mixmonitor.c: Place unlock of mutex in an else block
so
          that it does not get unlocked twice. (closes issue
https://issues.asterisk.org/view.php?id=15400)
          Reported by: aragon

Here is a diff on the two app_mixmonitor.c files:
--- ./asterisk-204000/apps/app_mixmonitor.c     2009-10-23
13:40:21.000000000 -0400
+++ ./asterisk-204012/apps/app_mixmonitor.c     2009-10-23
14:03:27.000000000 -0400
@@ -35,7 +35,7 @@
 
 #include "asterisk.h"
 
-ASTERISK_FILE_VERSION(__FILE__, "$Revision: 201423 $")
+ASTERISK_FILE_VERSION(__FILE__, "$Revision: 204012 $")
 
 #include <stdlib.h>
 #include <stdio.h>
@@ -273,8 +273,9 @@
                                        ast_writestream(*fs, cur);
                                }
                        }
+               } else {
+                      
ast_mutex_unlock(&mixmonitor->mixmonitor_ds->lock);
                }
-               ast_mutex_unlock(&mixmonitor->mixmonitor_ds->lock);
 
                /* All done! free it. */
                ast_frame_free(fr, 0);

Can mmichelson possibly take a look since he coded the revision in
question? 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-10-23 14:00 Ayth           Note Added: 0112679                          
======================================================================