[asterisk-bugs] [Asterisk 0016565]: crash: in "scheduled_destroy" at chan_iax2.c:1511

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=16565 
====================================================================== 
Reported By:                jensvb
Assigned To:                dvossel
====================================================================== 
Project:                    Asterisk
Issue ID:                   16565
Category:                   Channels/chan_iax2
Reproducibility:            have not tried
Severity:                   crash
Priority:                   normal
Status:                     assigned
Asterisk Version:           1.4.28 
JIRA:                        
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2010-01-07 11:30 CST
Last Modified:              2010-01-07 14:14 CST
====================================================================== 
Summary:                    crash: in "scheduled_destroy" at chan_iax2.c:1511
Description: 
Greetings,

I experienced an asterisk crash today. Full backtrace attached.

Why would callno be negative?

<snip>
https://issues.asterisk.org/view.php?id=2  0x00002aaac611437a in
scheduled_destroy (vid=0x8000) at
chan_iax2.c:1511
        callno = -32768
        __PRETTY_FUNCTION__ = "scheduled_destroy"
</snip>

I would appreciate any help or pointers with this issue.

Regards
Jens

====================================================================== 

---------------------------------------------------------------------- 
 (0116262) svnbot (reporter) - 2010-01-07 14:14
 https://issues.asterisk.org/view.php?id=16565#c116262 
---------------------------------------------------------------------- 
Repository: asterisk
Revision: 238411

U   branches/1.4/channels/chan_iax2.c

------------------------------------------------------------------------
r238411 | dvossel | 2010-01-07 14:14:25 -0600 (Thu, 07 Jan 2010) | 10
lines

fixes crash in "scheduled_destroy" in chan_iax

A signed short was used to represent a callnumber.  This is makes
it possible to attempt to access the iaxs array with a negative
index.

(closes issue https://issues.asterisk.org/view.php?id=16565)
Reported by: jensvb


------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=238411 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2010-01-07 14:14 svnbot         Note Added: 0116262                          
======================================================================