[asterisk-dev] channel.c seqfaults

[David Bowerman]

Hi all,

Im trying to get to the bottom of a segfault problem im having randomly.

tech is chan_cellphone (bluetooth cell phones)
version is both trunk and 1.4.0

im getting segfaults in channel.c here :-

	/* Check for pending read queue */
	if (!AST_LIST_EMPTY(&chan->readq)) {
		f = AST_LIST_REMOVE_HEAD(&chan->readq, frame_list);
		/* Interpret hangup and return NULL */
		/* XXX why not the same for frames from the channel ? */

as you can see from the core dump the chan->readq looks screwed :-

#0  0x0807cfc1 in __ast_read (chan=0x81624b0, dropaudio=0) at channel.c:2074
2074                    f = AST_LIST_REMOVE_HEAD(&chan->readq, frame_list);
(gdb) p chan->readq
$1 = {first = 0xfffff430, last = 0x8057198}
(gdb) p chan->readq->first
$2 = (struct ast_frame *) 0xfffff430
(gdb) p *chan->readq->first
Cannot access memory at address 0xfffff430
(gdb) p *chan->readq->last
$3 = {frametype = 314844671, subclass = -932706285, datalen =
-385875963, samples = -2992, mallocd = 315106815,
  mallocd_hdr_len = 3496478739, offset = -385875963, src = 0xfffff440
<Address 0xfffff440 out of bounds>,
  data = 0x12cc25ff, delivery = {tv_sec = -664270829, tv_usec =
-385875963}, frame_list = {next = 0xfffff430},
  has_timing_info = 315631103, ts = -530053101, len = -385875963, seqno = -3040}
(gdb)

The segfault happens usually the first outbound (tech_request() ->
tech_call()) call after the module is loaded, but only sometimes.

My question is does an ast_channel's readq member need to be
initialised somehow after a call to ast_channel_alloc() ?

any help would be appreciated.

regards

dave bowerman