[asterisk-bugs] [JIRA] (ASTERISK-26373) channel: Crash when appending cap during dialing to a channel

[Denis S.Davydov (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-26373?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=232294#comment-232294 ] 

Denis S.Davydov commented on ASTERISK-26373:
--------------------------------------------

bzgrep -B15000 -A1000 'by root' /var/log/asterisk/full-20160913-1473786061.bz2 > full_20160913_1457.txt

So the last 21 rows before crash was:
{code}
[Sep 13 14:57:23] DEBUG[12792] app_queue.c: Device 'SIP/3111' changed to state '1' (Not in use)
[Sep 13 14:57:23] DEBUG[12779] manager.c: Mansession: 0x7fa7222eddf8 refcount now 2
[Sep 13 14:57:23] DEBUG[12786][C-00000fb7] chan_sip.c: Acked pending invite 105
[Sep 13 14:57:23] DEBUG[12786][C-00000fb7] chan_sip.c: Stopping retransmission on 'zko1lkuokmbz19009b1an0z8lo1uoljx at SoftX3000' of Request 105: Match Found
[Sep 13 14:57:23] DEBUG[12779] manager.c: Mansession: 0x7fa6bc000d18 refcount now 2
[Sep 13 14:57:23] DEBUG[12779] manager.c: Mansession: 0x7fa6ec5e2318 refcount now 2
[Sep 13 14:57:23] DEBUG[12779] manager.c: Mansession: 0x7fa6e8000dd8 refcount now 2
[Sep 13 14:57:23] DEBUG[12779] manager.c: Mansession: 0x7fa6ee0869f8 refcount now 2
[Sep 13 14:57:23] DEBUG[12779] manager.c: Mansession: 0x7fa7154e8608 refcount now 2
[Sep 13 14:57:23] DEBUG[12779] manager.c: Mansession: 0x7fa7222eddf8 refcount now 2
[Sep 13 14:57:23] DEBUG[12786][C-00000fb7] rtp_engine.c: Setting tx payload type 8 based on m type on 0x7fa73c0a2030
[Sep 13 14:57:23] DEBUG[12786][C-00000fb7] rtp_engine.c: Setting tx payload type 101 based on m type on 0x7fa73c0a2030
[Sep 13 14:57:23] DEBUG[18303][C-00000fb7] app_queue.c: Trying 'SIP/3112' with metric 4
[Sep 13 14:57:23] DEBUG[12786][C-00000fb7] res_rtp_asterisk.c: Setting RTCP address on RTP instance '0x7fa6d5500ed8'
[Sep 13 14:57:23] DEBUG[12779] manager.c: Mansession: 0x7fa6bc000d18 refcount now 2
[Sep 13 14:57:23] DEBUG[12786][C-00000fb7] rtp_engine.c: Copying payload 8 (0x7fa6d4234ea0) from 0x7fa73c0a2030 to 0x7fa6d55010a0
[Sep 13 14:57:23] DEBUG[12779] manager.c: Mansession: 0x7fa6ec5e2318 refcount now 2
[Sep 13 14:57:23] DEBUG[12786][C-00000fb7] rtp_engine.c: Copying payload 101 (0x7fa6d404fe20) from 0x7fa73c0a2030 to 0x7fa6d55010a0
[Sep 13 14:57:23] DEBUG[12779] manager.c: Mansession: 0x7fa6e8000dd8 refcount now 2
[Sep 13 14:57:23] DEBUG[12786][C-00000fb7] res_rtp_asterisk.c: Ignoring duplicate RTCP property on RTP instance '0x7fa6d5500ed8'
[Sep 13 14:57:23] DEBUG[12779] manager.c: Mansession: 0x7fa6ee0869f8 refcount now 2
[Sep 13 14:57:29] Asterisk 13.11.2 built by root @ pbx.autoconnex.ru on a x86_64 running Linux on 2016-09-12 20:10:17 UTC
{code}

I have upgraded Asterisk from 13.10-rc1 to 13.11.2 with enabling debug options (early I have not debug options on my 13.10-rc1).

> channel: Crash when appending cap during dialing to a channel
> -------------------------------------------------------------
>
>                 Key: ASTERISK-26373
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-26373
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Core/Channels
>    Affects Versions: 13.11.2
>         Environment: Virtual Machine on ESXi6 (VM Version 11, 4vCPU, 16Gb RAM), OS: CentOS release 6.8 (Final) x86_84
>            Reporter: Denis S.Davydov
>            Assignee: Denis S.Davydov
>         Attachments: 20160913_1457.log, full_20160913_1457.txt, mmlog_20160913
>
>
> Sep 13 14:57:23 pbx kernel: asterisk[18303] general protection ip:526f83 sp:7fa6e1854340 error:0 in asterisk[400000+370000]
> Segmentation fault in ast_format_cap_append_from_cap.
> {code}
> Program terminated with signal 11, Segmentation fault.
> #0  0x0000000000526f83 in ast_format_cap_append_from_cap (dst=0x7fa731384ab0, src=0x7fa6d5098350, type=AST_MEDIA_TYPE_UNKNOWN) at format_cap.c:308
> 308			struct format_cap_framed *framed = AST_VECTOR_GET(&src->preference_order, idx);
> #0  0x0000000000526f83 in ast_format_cap_append_from_cap (dst=0x7fa731384ab0, src=0x7fa6d5098350, type=AST_MEDIA_TYPE_UNKNOWN) at format_cap.c:308
>         __idx = 0
>         framed = 0x7fa6d512f190
>         idx = 0
>         res = 0
> #1  0x00000000004c2e53 in ast_request (type=0x7fa6e1854580 "SIP", request_cap=0x7fa6d5098350, assignedids=0x0, requestor=0x7fa6d54b3068, addr=0x7fa6e1854584 "3112", cause=0x7fa6e1854680) at channel.c:6068
>         tmp_cap = 0x7fa7313bf700
>         tmp_fmt = 0xbc67d0
>         best_audio_fmt = 0xbc67d0
>         joint_cap = 0x7fa731384ab0
>         chan = 0x17a62c0
>         c = 0x7fa6e1855fc0
>         res = 0
>         foo = 32679
>         __PRETTY_FUNCTION__ = "ast_request"
> {code}
> backtrace.txt and full.txt are in attachment.
> Compiled flags on my Asterisk-PBX is DONT_OPTIMIZE, COMPILE_DOUBLE, LOADABLE_MODULES, BETTER_BACKTRACES, MALLOC_DEBUG, BULD_NATIVE. Mmlog useless, there's nothing.



--
This message was sent by Atlassian JIRA
(v6.2#6252)