[asterisk-bugs] [Asterisk 0017352]: [patch] Asterisk deadlock

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=17352 
====================================================================== 
Reported By:                aleksey2000
Assigned To:                dvossel
====================================================================== 
Project:                    Asterisk
Issue ID:                   17352
Category:                   Channels/chan_sip/General
Reproducibility:            random
Severity:                   major
Priority:                   normal
Status:                     feedback
Asterisk Version:           1.6.2.7 
JIRA:                       SWP-1508 
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2010-05-18 05:11 CDT
Last Modified:              2010-05-19 15:30 CDT
====================================================================== 
Summary:                    [patch] Asterisk deadlock
Description: 
This asterisk used for transit traffic between MERA and unknown Cisco
device. Protocol: SIP Full proxy. Accept alaw, g729 than convert to alaw.
Timing: dahdi.
Usually,  after 2-3 hours asterisk going to deadlock. Average channels: 20
- 40.

Deadlock happened on 1.6.1.18, 1.6.1.19, 1.6.2.7. (with AGI (a2billing)
and without)


====================================================================== 

---------------------------------------------------------------------- 
 (0122191) svnbot (reporter) - 2010-05-19 15:30
 https://issues.asterisk.org/view.php?id=17352#c122191 
---------------------------------------------------------------------- 
Repository: asterisk
Revision: 264400

U   trunk/main/udptl.c

------------------------------------------------------------------------
r264400 | dvossel | 2010-05-19 15:30:33 -0500 (Wed, 19 May 2010) | 11
lines

fixes infinite loop during udptl.c's decode_open_type

When decode_length returns the length there is a check to see if that
length is negative, if so the decode loop breaks as this means the
limit has been reached.  The problem here is that length is an
unsigned int, so length can never be negative.  This resulted in
an infinite loop.

(issue https://issues.asterisk.org/view.php?id=17352)


------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=264400 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2010-05-19 15:30 svnbot         Checkin                                      
2010-05-19 15:30 svnbot         Note Added: 0122191                          
======================================================================