[asterisk-bugs] [Asterisk 0017365]: Race condition causes manager session event list to underflow causing null pointer de-ref and crash.

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=17365 
====================================================================== 
Reported By:                davidw
Assigned To:                tilghman
====================================================================== 
Project:                    Asterisk
Issue ID:                   17365
Category:                   Core/ManagerInterface
Reproducibility:            sometimes
Severity:                   crash
Priority:                   normal
Status:                     closed
Asterisk Version:           SVN 
JIRA:                        
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): 1.6.2 
SVN Revision (number only!): 264112 
Request Review:              
Resolution:                 fixed
Fixed in Version:           
====================================================================== 
Date Submitted:             2010-05-20 12:26 CDT
Last Modified:              2010-06-01 11:42 CDT
====================================================================== 
Summary:                    Race condition causes manager session event list to
underflow causing null pointer de-ref and crash.
Description: 
There is a flaw in the reference count logic for events in manager.c which
means about once in the order of 100,000,000 events, the last event gets
purged, resulting in a trying to dereference a null last_ev pointer at:

0x0811b951 in process_events (s=0xb773819c) at manager.c:2685
2685       while ( (eqe = NEW_EVENT(s)) ) {

Scenario.  Run Asterisk for long enough with a manager logged in and
events being generated.

Expect.  Nothing untoward.

Get. Crash, as above.
======================================================================
Relationships       ID      Summary
----------------------------------------------------------------------
related to          0017234 [patch] Memory leak in manager.c
====================================================================== 

---------------------------------------------------------------------- 
 (0122709) svnbot (reporter) - 2010-06-01 11:42
 https://issues.asterisk.org/view.php?id=17365#c122709 
---------------------------------------------------------------------- 
Repository: asterisk
Revision: 266683

_U  branches/1.6.2/
U   branches/1.6.2/main/manager.c

------------------------------------------------------------------------
r266683 | tilghman | 2010-06-01 11:42:02 -0500 (Tue, 01 Jun 2010) | 23
lines

Merged revisions 266682 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/trunk

........
  r266682 | tilghman | 2010-06-01 11:41:00 -0500 (Tue, 01 Jun 2010) | 16
lines
  
  Eliminate stale manager events after a set interval, even if AMI clients
don't query for them.
  
  Actions (or failures to act) by external clients should not cause memory
leaks
  in Asterisk, especially when those continued leaks could cause Asterisk
to
  misbehave later.
  
  (closes issue https://issues.asterisk.org/view.php?id=17234)
   Reported by: mav3rick
   Patches: 
         20100510__issue17234.diff.txt uploaded by tilghman (license 14)
         20100517__issue17234__trunk.diff.txt uploaded by tilghman
(license 14)
   Tested by: mav3rick, davidw
  
  (closes issue https://issues.asterisk.org/view.php?id=17365)
   Reported by: davidw
........

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=266683 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2010-06-01 11:42 svnbot         Checkin                                      
2010-06-01 11:42 svnbot         Note Added: 0122709                          
======================================================================