[asterisk-bugs] [JIRA] (ASTERISK-26987) Asterisk crashes when unloading module pbx_dundi.so with dundi peers

[Kirsty Tyerman (JIRA)]

Kirsty Tyerman created ASTERISK-26987:
-----------------------------------------

             Summary: Asterisk crashes when unloading module pbx_dundi.so with dundi peers
                 Key: ASTERISK-26987
                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-26987
             Project: Asterisk
          Issue Type: Bug
      Security Level: None
          Components: PBX/pbx_dundi
    Affects Versions: 13.9.1
         Environment: Fedora 25
            Reporter: Kirsty Tyerman


I have compiled Asterisk 13.9.1 on a Fedora 25 Workstation.

I have configured "dundi.conf" with one dundi peer as follows, using my local ip address as the bindaddr.
{noformat}
[general]
entityid=11:11:11:de:af:1
bindaddr=192.168.122.21
cachetime=5
ttl=32
tos=cs5
autokill=no

[11:11:11:00:a1:1]
model=symmetric
include=all
host=172.16.66.1
permit=all
qualify=30000
{noformat}

When I try to unload the dundi module (module unload pbx_dundi.so), asterisk crashes with a segmentation fault as follows:
{noformat}
*CLI> module unload pbx_dundi.so 
 Unloading pbx_dundi.so
  == Unregistered custom function DUNDILOOKUP
  == Unregistered custom function DUNDIQUERY
  == Unregistered custom function DUNDIRESULT
[Thread 0x7fff6a33d700 (LWP 27801) exited]
[Thread 0x7fff6a2c1700 (LWP 27802) exited]
[Thread 0x7fff6a245700 (LWP 27803) exited]

Thread 1 "asterisk" received signal SIGSEGV, Segmentation fault.
0x0000000000527362 in ast_heap_size (h=0x0) at heap.c:311
311		return h->cur_len;
(gdb) where
#0  0x0000000000527362 in ast_heap_size (h=0x0) at heap.c:311
#1  0x00000000005bc45e in sched_find (con=0xc9ed90, id=1) at sched.c:582
#2  0x00000000005bc59f in ast_sched_del (con=0xc9ed90, id=1) at sched.c:634
#3  0x00007fff8761123b in destroy_peer (peer=0x12a3150) at pbx_dundi.c:4333
#4  0x00007fff87611426 in prune_peers () at pbx_dundi.c:4354
#5  0x00007fff87614456 in unload_module () at pbx_dundi.c:4987
#6  0x0000000000537a9f in ast_unload_resource (resource_name=0x12ca50e "pbx_dundi.so", force=AST_FORCE_SOFT)
    at loader.c:704
#7  0x00000000004d2392 in handle_unload (e=0x8b3048 <cli_cli+3400>, cmd=-4, a=0x7fffffffb920) at cli.c:769
#8  0x00000000004d87be in ast_cli_command_full (uid=-1, gid=-1, fd=1, s=0xb18a10 "module unload pbx_dundi.so ")
    at cli.c:2757
#9  0x0000000000455301 in consolehandler (s=0xb18a10 "module unload pbx_dundi.so ") at asterisk.c:2328
#10 0x000000000045c132 in asterisk_daemon (isroot=1, runuser=0x0, rungroup=0x0) at asterisk.c:4797
#11 0x000000000045af76 in main (argc=2, argv=0x7fffffffe0b8) at asterisk.c:4289
{noformat}

If i remove qualify from the dundi peer and then load and unload the pbx_dundi.so module asterisk does not crash.

*STEPS TO REPRODUCE*
1. dnf install asterisk-13.9.1
2. use dundi.conf file supplied in attatchments (edit bindaddr to match local ip address)
3. start asterisk
4. connect to the asterisk CLI
5. module unload pbx_dundi.so



--
This message was sent by Atlassian JIRA
(v6.2#6252)