[asterisk-dev] Sporadic crash in mp3 code

[Dave Hawkes]

Hi,

I was getting sporadic crashes in asterisk and after enabling debug
information I tracked it down to read_buf_byte in
asterisk-addons/format_mp3/interface.c and the following patch appears
to fix the problem:

Index: interface.c
===================================================================
--- interface.c    (revision 282)
+++ interface.c    (working copy)
@@ -106,7 +106,6 @@
      pos = mp->tail->pos;
      while(pos >= mp->tail->size) {
          remove_buf(mp);
-        pos = mp->tail->pos;
          if(!mp->tail) {
              /* We may pick up this error a few times*/
              /* But things have gone pear shaped */
@@ -114,6 +113,7 @@
              *error = 1;
              return (0);
          }
+        pos = mp->tail->pos;
      }

      b = mp->tail->pnt[pos];


As you can see if mp->tail is NULL then the pos = mp->tail->pos line 
crashes due to a NULL pointer access. Interestingly tail is only NULL
when MOH is played as a call is parked and then not every time...

Dave Hawkes


-------------- next part --------------
A non-text attachment was scrubbed...
Name: daveh.vcf
Type: text/x-vcard
Size: 273 bytes
Desc: not available
Url : http://lists.digium.com/pipermail/asterisk-dev/attachments/20061004/38afdeca/daveh.vcf