[asterisk-bugs] [Asterisk 0016565]: crash: in "scheduled_destroy" at chan_iax2.c:1511

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=16565 
====================================================================== 
Reported By:                jensvb
Assigned To:                dvossel
====================================================================== 
Project:                    Asterisk
Issue ID:                   16565
Category:                   Channels/chan_iax2
Reproducibility:            have not tried
Severity:                   crash
Priority:                   normal
Status:                     closed
Asterisk Version:           1.4.28 
JIRA:                        
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
Resolution:                 fixed
Fixed in Version:           
====================================================================== 
Date Submitted:             2010-01-07 11:30 CST
Last Modified:              2010-01-07 14:20 CST
====================================================================== 
Summary:                    crash: in "scheduled_destroy" at chan_iax2.c:1511
Description: 
Greetings,

I experienced an asterisk crash today. Full backtrace attached.

Why would callno be negative?

<snip>
https://issues.asterisk.org/view.php?id=2  0x00002aaac611437a in
scheduled_destroy (vid=0x8000) at
chan_iax2.c:1511
        callno = -32768
        __PRETTY_FUNCTION__ = "scheduled_destroy"
</snip>

I would appreciate any help or pointers with this issue.

Regards
Jens

====================================================================== 

---------------------------------------------------------------------- 
 (0116265) svnbot (reporter) - 2010-01-07 14:20
 https://issues.asterisk.org/view.php?id=16565#c116265 
---------------------------------------------------------------------- 
Repository: asterisk
Revision: 238430

_U  branches/1.6.1/
U   branches/1.6.1/channels/chan_iax2.c

------------------------------------------------------------------------
r238430 | dvossel | 2010-01-07 14:20:38 -0600 (Thu, 07 Jan 2010) | 23
lines

Merged revisions 238412 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/trunk

................
  r238412 | dvossel | 2010-01-07 14:15:27 -0600 (Thu, 07 Jan 2010) | 16
lines
  
  Merged revisions 238411 via svnmerge from 
  https://origsvn.digium.com/svn/asterisk/branches/1.4
  
  ........
    r238411 | dvossel | 2010-01-07 14:14:25 -0600 (Thu, 07 Jan 2010) | 10
lines
    
    fixes crash in "scheduled_destroy" in chan_iax
    
    A signed short was used to represent a callnumber.  This is makes
    it possible to attempt to access the iaxs array with a negative
    index.
    
    (closes issue https://issues.asterisk.org/view.php?id=16565)
    Reported by: jensvb
  ........
................

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=238430 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2010-01-07 14:20 svnbot         Checkin                                      
2010-01-07 14:20 svnbot         Note Added: 0116265                          
======================================================================