[asterisk-bugs] [Asterisk 0018415]: Asterisk 1.8.1-rc1 crashes in cdr.c line 1201 after a parked call catched with parkedcall() is hungup

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=18415 
====================================================================== 
Reported By:                macbrody
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   18415
Category:                   CDR/General
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     new
Asterisk Version:           1.8.1-rc1 
JIRA:                        
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2010-12-03 08:10 CST
Last Modified:              2010-12-06 15:18 CST
====================================================================== 
Summary:                    Asterisk 1.8.1-rc1 crashes in cdr.c line 1201 after
a parked call catched with parkedcall() is hungup
Description: 
The following combination makes asterisk-1.8.1-rc1 crash in cdr.c no matter
if
there is any config file for cdr or not:

call gets parked:
exten => _*81ZXX,n,Park(120000,CTX_ParkTimeout,s,1,s)

other person picks up the call:
exten => _*82ZXX,n,Set(CDR(userfield)=${USERFIELD})
exten => _*82ZXX,n,ParkedCall(${EXTEN:3})

either party hangs up:
asterisk crashes creating a core dump.

The output of the core dump in gdb:
>Core was generated by `/opt/asterisk/sbin/asterisk -f -vvvg -c'.
>Program terminated with signal 11, Segmentation fault.
>https://issues.asterisk.org/view.php?id=0  ast_cdr_specialized_reset (cdr=0x0,
_flags=0x0) at cdr.c:1201
>1201            if (ast_test_flag(cdr, AST_CDR_FLAG_POST_DISABLED)) { /*
But do NOT lose the NoCDR() setting */



====================================================================== 

---------------------------------------------------------------------- 
 (0129369) jsolares (reporter) - 2010-12-06 15:18
 https://issues.asterisk.org/view.php?id=18415#c129369 
---------------------------------------------------------------------- 
found the problem, and why it only crashes when cdr(userfield) is set, line
3163 has a peer->cdr = NULL, and it's only set when copying over the
userfield.

/* copy the userfield from the B-leg to A-leg if applicable */
        if (chan->cdr && peer->cdr &&
!ast_strlen_zero(peer->cdr->userfield)) {
                char tmp[256];
                if (!ast_strlen_zero(chan->cdr->userfield)) {
                        snprintf(tmp, sizeof(tmp), "%s;%s",
chan->cdr->userfield, peer->cdr->userfield);
                        ast_cdr_appenduserfield(chan, tmp);
                } else
                        ast_cdr_setuserfield(chan, peer->cdr->userfield);
                /* free the peer's cdr without ast_cdr_free complaining
*/
                ast_free(peer->cdr);
                peer->cdr = NULL;
        }

so the userfield gets copied over from peer to chan, but then peer->cdr
gets freed, i don't know enough of the code to know why we should do it
tho. 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2010-12-06 15:18 jsolares       Note Added: 0129369                          
======================================================================