[asterisk-bugs] [Asterisk 0017264]: Crash when using Background() in Macro called by M() option to Dial()

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=17264 
====================================================================== 
Reported By:                falves11
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   17264
Category:                   Applications/app_dial
Reproducibility:            random
Severity:                   crash
Priority:                   normal
Status:                     acknowledged
Asterisk Version:           1.6.1.18 
JIRA:                       SWP-1397 
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): 1.6.1 
SVN Revision (number only!): 259958 
Request Review:              
====================================================================== 
Date Submitted:             2010-04-29 17:27 CDT
Last Modified:              2010-05-14 12:21 CDT
====================================================================== 
Summary:                    Crash when using Background() in Macro called by M()
option to Dial()
Description: 
This the section where it blows up.

exten
=>_X.,n,Dial(${CUT(CARRIERLIST,-,${i})},${CUT(TO,-,${i})},M(get-callid^${PROMPT})L(10800000))
;dial once

[macro-get-callid]
exten => s,1,Verbose(2,Playing ${ARG1})
exten => s,n,GotoIf($["${ARG1}" = "0" ]?salida)
exten => s,n,Background(${ARG1})
exten => s,n(salida),MacroExit
====================================================================== 

---------------------------------------------------------------------- 
 (0121917) falves11 (reporter) - 2010-05-14 12:21
 https://issues.asterisk.org/view.php?id=17264#c121917 
---------------------------------------------------------------------- 
Please review this patch proposed and if you like it, I will upload as a
file.
In all cores you can see a NULL deference from udptl. Watching caller
(interpret_t38_parameters) p is correct but p->udptl is NULL. Previous
member is zeroed but this indicate probably initialization to zero (not
used), all socket address structures are IPV4 so probably udptl was not
initialized. You could use a temporarily patch like this

--- ./main/udptl.c.orig	2010-05-14 13:15:01.000000000 -0400
+++ ./main/udptl.c	2010-05-14 13:15:59.000000000 -0400
@@ -865,7 +865,7 @@
 {
 	/* make sure max_ifp is a positive value since a cast will take place
when
 	 * when setting local_max_ifp */
-	if ((signed int) max_ifp > 0) {
+	if (udptl && (signed int) max_ifp > 0) {
 		udptl->local_max_ifp = max_ifp;
 		/* reset calculated values so they'll be computed again */
 		udptl->local_max_datagram = -1; 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2010-05-14 12:21 falves11       Note Added: 0121917                          
======================================================================