[asterisk-bugs] [JIRA] (ASTERISK-23135) Asterisk goes down with segfault in ast_channel_hangupcause_set

[David Woolley (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-23135?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=213991#comment-213991 ] 

David Woolley commented on ASTERISK-23135:
------------------------------------------

It looks like the SIP device is responding inappropriately to a CANCEL by sending 200 OK, rather than request cancelled, with the old style hold state (0 as the RTP port number), on the INVITE  transaction.  Whilst that could happen as a collision, it seems unlikely.  I don't know if it is just the 200 response, or the combination with the hold.
                
> Asterisk goes down with segfault  in ast_channel_hangupcause_set
> ----------------------------------------------------------------
>
>                 Key: ASTERISK-23135
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-23135
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>    Affects Versions: 11.7.0
>         Environment: Ubuntu 12.04.3
>            Reporter: OK
>            Severity: Critical
>         Attachments: backtrace2.txt, dump.txt
>
>
> Asterisk goes down with segfault message
> [1710042.449224] asterisk[26863]: segfault at 9f0 ip 00000000004984ff sp 00007ff1788ed810 error 6 in asterisk[400000+233000]
> Program terminated with signal 11, Segmentation fault.
> #0  0x00000000004984ff in ast_channel_hangupcause_set (chan=0x0, value=58) at channel_internal_api.c:580
> 580             chan->hangupcause = value;
> (gdb) bt
> #0  0x00000000004984ff in ast_channel_hangupcause_set (chan=0x0, value=58) at channel_internal_api.c:580
> #1  0x00007ff17ca7417b in handle_response_invite (p=0x7ff0b81d2f98, resp=200, rest=0x7ff1380b89d4 "OK", req=0x7ff1788ee2a0, seqno=102) at chan_sip.c:22821
> #2  0x00007ff17ca79a2a in handle_response (p=0x7ff0b81d2f98, resp=200, rest=0x7ff1380b89d4 "OK", req=0x7ff1788ee2a0, seqno=102) at chan_sip.c:23820
> #3  0x00007ff17ca8d538 in handle_incoming (p=0x7ff0b81d2f98, req=0x7ff1788ee2a0, addr=0x7ff1788eed10, recount=0x7ff1788ee250, nounlock=0x7ff1788ee254) at chan_sip.c:28137
> #4  0x00007ff17ca8ebe9 in handle_request_do (req=0x7ff1788ee2a0, addr=0x7ff1788eed10) at chan_sip.c:28447
> #5  0x00007ff17ca8e7d2 in sipsock_read (id=0x7ff138000f70, fd=10, events=1, ignore=0x0) at chan_sip.c:28378
> #6  0x0000000000501f9a in ast_io_wait (ioc=0x1552f30, howlong=576) at io.c:292
> #7  0x00007ff17ca90808 in do_monitor (data=0x0) at chan_sip.c:28976
> #8  0x000000000059f064 in dummy_start (data=0x15848d0) at utils.c:1162
> #9  0x00007ff1c53a6e9a in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
> #10 0x00007ff1c64ec3fd in clone () from /lib/x86_64-linux-gnu/libc.so.6
> #11 0x0000000000000000 in ?? ()
> Full Backtrace attached
> Also in all cases the last messages in log file are:
> [Jan 12 08:56:55] WARNING[26863][C-000001f4] chan_sip.c: Ignoring audio media offer because port number is zero
> [Jan 12 08:56:55] WARNING[26863][C-000001f4] chan_sip.c: Failing due to no acceptable offer found
> [Jan 12 13:01:02] Asterisk 11.7.0 built by root @ mcall-aster on a x86_64 running Linux on 2014-01-11 13:59:57 UTC

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.asterisk.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira