[asterisk-bugs] [JIRA] (ASTERISK-21297) Segmentation fault on hangup in in ast_bridged_channel

[Matt Jordan (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-21297?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=204764#comment-204764 ] 

Matt Jordan commented on ASTERISK-21297:
----------------------------------------

It's probably good to note that this occurred when two SIP channels couldn't be made compatible:

{noformat}
[Mar 16 19:47:54] WARNING[13963][C-00000857] channel.c: Unable to set write format on channel SIP/in.voipi.com.ar-000010af to alaw
[Mar 16 19:47:54] WARNING[13963][C-00000857] channel.c: Can't make SIP/asteriskld2-000010ae and SIP/in.voipi.com.ar-000010af compatible
[Mar 16 19:47:54] WARNING[13963][C-00000857] features.c: Bridge failed on channels SIP/asteriskld2-000010ae and SIP/in.voipi.com.ar-000010af
{noformat}

                
> Segmentation fault on hangup in in ast_bridged_channel
> ------------------------------------------------------
>
>                 Key: ASTERISK-21297
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-21297
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Core/Bridging
>    Affects Versions: 11.0.1
>         Environment: Ubuntu 10.04.2 
> Kernel 2.6.38
>            Reporter: German Becker
>         Attachments: backtrace.txt, full-recortado.txt
>
>
> Function ast_bridged_channel in main/channel.c generates segmentation fault. It happens seldom, I couldn't reproduce, but I think it happens when releasing call at both channels at the same time, timing issue.
> Here is the function:
> {code}
> struct ast_channel *ast_bridged_channel(struct ast_channel *chan)
> {
>         struct ast_channel *bridged;
>         bridged = ast_channel_internal_bridged_channel(chan);
>         if (bridged && ast_channel_tech(bridged)->bridged_channel)
>                 bridged = ast_channel_tech(bridged)->bridged_channel(chan, bridged);
>         return bridged;
> }
> {code}
> The segfault rises because bridged is not NULL, but ast_channel_tech(bridged) is NULL so the dereference produces a segfault. I'm not sure why it is null, but I think it is related to timing as said before. 
> A possible fix would be to check that ast_channel_tech(bridged) is not null.
> i.e:
> {code}
> struct ast_channel *ast_bridged_channel(struct ast_channel *chan)
> {
>         struct ast_channel *bridged;
>         bridged = ast_channel_internal_bridged_channel(chan);
>         if (bridged && ast_channel_tech(bridged) && 
>            ast_channel_tech(bridged)->bridged_channel)
>                 bridged = ast_channel_tech(bridged)->bridged_channel(chan, bridged);
>         return bridged;
> }
> {code}

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.asterisk.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira