[asterisk-bugs] [JIRA] (ASTERISK-28086) Segfault in ast_senddigit_end using PJSIP

[Jeremiah Gadd (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-28086?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jeremiah Gadd updated ASTERISK-28086:
-------------------------------------

    Description: 
It appears there may be a race condition in which PJSIP attempts to end the sending of a DTMF tone after a bridge is destroyed, causing PJSIP to try to send to a non-existent channel.

I've attached the corresponding core dumps.

Thread 1 (Thread 0x7f45562ef700 (LWP 3781)):
#0  0x00007f49d9b49233 in ?? () from /usr/lib64/asterisk/modules/chan_pjsip.so
#1  0x00000000004b5fe7 in ast_senddigit_end ()
#2  0x00007f49da56d29c in ?? () from /usr/lib64/asterisk/modules/app_senddtmf.so
#3  0x000000000054ce1e in ?? ()
#4  0x000000000054fbaa in ?? ()
#5  0x00000000005dd2dd in ?? ()
#6  0x00000000005eb91a in ?? ()
#7  0x00007f4a6a065f3a in __pthread_mutex_unlock_full () from /lib64/libpthread.so.0
#8  0xb5e6219ff3277d21 in ?? ()
#9  0x0000000000000000 in ?? ()


  was:
It appears there may be a race condition in which PJSIP attempts to end the sending of a DTMF tone after a bridge is destroyed, causing PJSIP to try to send to a non-existent channel.

I'm happy to post as much of the core dumps as needed, I could not find a way to attach them to this report.

Thread 1 (Thread 0x7f45562ef700 (LWP 3781)):
#0  0x00007f49d9b49233 in ?? () from /usr/lib64/asterisk/modules/chan_pjsip.so
#1  0x00000000004b5fe7 in ast_senddigit_end ()
#2  0x00007f49da56d29c in ?? () from /usr/lib64/asterisk/modules/app_senddtmf.so
#3  0x000000000054ce1e in ?? ()
#4  0x000000000054fbaa in ?? ()
#5  0x00000000005dd2dd in ?? ()
#6  0x00000000005eb91a in ?? ()
#7  0x00007f4a6a065f3a in __pthread_mutex_unlock_full () from /lib64/libpthread.so.0
#8  0xb5e6219ff3277d21 in ?? ()
#9  0x0000000000000000 in ?? ()



> Segfault in ast_senddigit_end using PJSIP
> -----------------------------------------
>
>                 Key: ASTERISK-28086
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-28086
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: pjproject/pjsip
>    Affects Versions: 13.19.0
>         Environment: Gentoo (physical), Debian (AWS)
>            Reporter: Jeremiah Gadd
>              Labels: pjsip
>         Attachments: core-20180926-094817-brief.txt, core-20180926-094817-full.txt, core-20180926-094817-locks.txt, core-20180926-094817-thread1.txt
>
>
> It appears there may be a race condition in which PJSIP attempts to end the sending of a DTMF tone after a bridge is destroyed, causing PJSIP to try to send to a non-existent channel.
> I've attached the corresponding core dumps.
> Thread 1 (Thread 0x7f45562ef700 (LWP 3781)):
> #0  0x00007f49d9b49233 in ?? () from /usr/lib64/asterisk/modules/chan_pjsip.so
> #1  0x00000000004b5fe7 in ast_senddigit_end ()
> #2  0x00007f49da56d29c in ?? () from /usr/lib64/asterisk/modules/app_senddtmf.so
> #3  0x000000000054ce1e in ?? ()
> #4  0x000000000054fbaa in ?? ()
> #5  0x00000000005dd2dd in ?? ()
> #6  0x00000000005eb91a in ?? ()
> #7  0x00007f4a6a065f3a in __pthread_mutex_unlock_full () from /lib64/libpthread.so.0
> #8  0xb5e6219ff3277d21 in ?? ()
> #9  0x0000000000000000 in ?? ()



--
This message was sent by Atlassian JIRA
(v6.2#6252)