[asterisk-bugs] [JIRA] (ASTERISK-27238) Yet another crash freeing a frame that's already been freed

[Richard Kenner (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-27238?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=238740#comment-238740 ] 

Richard Kenner commented on ASTERISK-27238:
-------------------------------------------

I was concerned about reproducability because I didn't think that a bug this serious could be in the system, but it's slin16 native.  I've also seen this (and other errors) with the Digium Siren14 codec, but the time I ran valgrind and posted the results, it was a single Aastra 6867i phone with this in its config file:

{noformat}
sip use basic codecs: 1
sip silence suppression: 0
sip vmail: "#6"
sip customized codec: payload=0;ptime=30;silsupp=off,payload=8;ptime=30;silsupp=off,payload=18;ptime=30;silsupp=off,payload=113;ptime=30;silsupp=off
{noformat}

and it negotiated as native slin16.

> Yet another crash freeing a frame that's already been freed
> -----------------------------------------------------------
>
>                 Key: ASTERISK-27238
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-27238
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Core/Bridging
>    Affects Versions: 14.6.0
>         Environment: Centos 7
>            Reporter: Richard Kenner
>            Assignee: Richard Kenner
>         Attachments: confbridge.conf, traceback.txt, valgrind.txt
>
>
> See traceback.txt traceback.  The frame being freed is below:
> {noformat}
> $2 = {frametype = AST_FRAME_VOICE, subclass = {integer = 0, 
>     format = 0x24bc940, frame_ending = 0}, datalen = 0, samples = 320, 
>   mallocd = 1, mallocd_hdr_len = 545, offset = 64, 
>   src = 0x7f554c00c7a8 "func_jitterbuffer interpolation", data = {ptr = 0x0, 
>     uint32 = 0, pad = "\000\000\000\000\000\000\000"}, delivery = {
>     tv_sec = 1504146592, tv_usec = 647484}, frame_list = {
>     next = 0x7f5544002de0}, flags = 0, ts = 0, len = 0, seqno = 0}
> {noformat}



--
This message was sent by Atlassian JIRA
(v6.2#6252)