[asterisk-bugs] [Asterisk 0017567]: Asterisk crashes after redirect

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=17567 
====================================================================== 
Reported By:                Drasha
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   17567
Category:                   Channels/chan_sip/General
Reproducibility:            always
Severity:                   crash
Priority:                   normal
Status:                     feedback
Asterisk Version:           1.6.2.7 
JIRA:                       SWP-1800 
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2010-06-30 02:03 CDT
Last Modified:              2010-07-19 10:43 CDT
====================================================================== 
Summary:                    Asterisk crashes after redirect
Description: 
A phone 'A' is registered to Asterisk
A phone 'B' is outside Asterisk, calling via trunk between Asterisk and
Avaya Gateway
The phone 'A' is set to redirect all calls to phone 'C' that is also
registered to Asterisk.

A situation before crash:

1) B calls A
2) A redirects to C
3) B and C are connected
4) Call is normally terminated
... crash occurs here ...
======================================================================
Relationships       ID      Summary
----------------------------------------------------------------------
related to          0017363 [patch] Redirecting ;1 side of local ch...
====================================================================== 

---------------------------------------------------------------------- 
 (0124713) Drasha (reporter) - 2010-07-19 10:43
 https://issues.asterisk.org/view.php?id=17567#c124713 
---------------------------------------------------------------------- 
Once again, sorry for the delay. Unfortunately, supplied patch did not fix
the issue. I am attaching a log from valgrind showing writes into already
freed memory.

==4417== Invalid write of size 4
==4417==    at 0x4EE73C: ast_bt_get_addresses (logger.c:1200)
==4417==    by 0x44D98E: __ast_pthread_mutex_lock (lock.h:506)
==4417==    by 0x44FA72: audio_audiohook_write_list (audiohook.c:672)
==4417==    by 0x44FD83: ast_audiohook_write_list (audiohook.c:737)
==4417==    by 0x474FB2: __ast_read (channel.c:3074)
==4417==    by 0x4756C9: ast_read (channel.c:3163)
==4417==    by 0x47CC03: ast_generic_bridge (channel.c:5043)
==4417==    by 0x47EF3C: ast_channel_bridge (channel.c:5447)
==4417==    by 0x4BE681: ast_bridge_call (features.c:2605)
==4417==    by 0xA2B9D55: dial_exec_full (app_dial.c:2260)
==4417==    by 0xA2BA713: dial_exec (app_dial.c:2344)
==4417==    by 0x5053DD: pbx_exec (pbx.c:1348)
==4417==  Address 0x2ce1c810 is 544 bytes inside a block of size 8,400
free'd
==4417==    at 0x4C2130F: free (vg_replace_malloc.c:323)
==4417==    by 0x12CB4D24: destroy_callback (func_volume.c:71)
==4417==    by 0x4955EF: ast_datastore_free (datastore.c:64)
==4417==    by 0x46F6C8: ast_channel_free (channel.c:1479)
==4417==    by 0x47129A: ast_hangup (channel.c:1854)
==4417==    by 0x513697: __ast_pbx_run (pbx.c:4470)
==4417==    by 0x5139D0: pbx_thread (pbx.c:4562)
==4417==    by 0x57D1D8: dummy_start (utils.c:968)
==4417==    by 0x5CCBFC6: start_thread (in /lib/libpthread-2.7.so)
==4417==    by 0x54E15AC: clone (in /lib/libc-2.7.so)

Do you have any suggestion? 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2010-07-19 10:43 Drasha         Note Added: 0124713                          
======================================================================