[asterisk-dev] Corruption in moh on 1.6.2

[Mark Murawski]

  Any time I try and upgrade this one machine from 1.6.0 to 1.6.2 I'm 
seeing memory issues affecting music on hold as well as parts of sip 
(outgoing sip messages get mangled as well once the corruption sets 
in).  1.6.0.19 has been the last stable asterisk that I can use for this 
box.  I've tried everything from 1.6.2.0 to 1.6.2.11, as new versions 
come out... they all exhibit this same behavior.

pbxA*CLI> moh show classes
Class: ring
         Mode: files
         Directory: /var/lib/asterisk/mohring
Class: È5ϯá
         Mode: ontent-Type: application/sdp
         Directory: 
ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³                                                    
`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`                                                    
ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³
         Application: 
ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³ø`³
         Format: unknown
pbxA*CLI>
pbxA*CLI> \
<crash>
Disconnected from Asterisk server
Executing last minute cleanups

This and the backtrace is the only data I have so far.  The problem is I 
haven't been able to duplicate this on a test machine... only on the 
production machine, otherwise I would run valgrind.

Oh... anyone have  a valgrind suppressions file for 1.6.2?  There's way 
more stuff that needs to be ignored when doing 1.6.2 verus 1.6.0 so it's 
going to be a long time before I complete building the suppression file 
for it.



#0  0xffffe424 in __kernel_vsyscall ()
#1  0xb74e58e0 in *__GI_raise (sig=6)
     at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2  0xb74e8e15 in *__GI_abort () at abort.c:88
#3  0xb751c6c5 in __libc_message (do_abort=2,
     fmt=0xb75e30e8 "*** glibc detected *** %s: %s: 0x%s ***\n")
     at ../sysdeps/unix/sysv/linux/libc_fatal.c:173
#4  0xb7526824 in malloc_printerr (action=2,
     str=0xb75e3270 "double free or corruption (out)", ptr=0xafcf35c8)
     at malloc.c:6239
#5  0xb75280b3 in _int_free (av=0xb75ff3c0, p=0xafcf35c0) at malloc.c:4772
#6  0xb752b0dd in *__GI___libc_free (mem=0xafcf35c8) at malloc.c:3738
#7  0x080d8706 in ast_event_destroy (event=0xafcf35c8) at event.c:1017
#8  0x080d8721 in ast_event_ref_destroy (obj=0xafcf4f48) at event.c:1024
#9  0x08086331 in __ao2_ref (user_data=0xafcf4f48, delta=-1) at 
astobj2.c:325
#10 0x0808626d in _ao2_ref (user_data=0xafcf4f48, delta=-1) at astobj2.c:295
#11 0xb6b09d83 in ?? () from /usr/lib/asterisk/modules/res_musiconhold.so
#12 0x080ba88f in ast_cli_command_full (uid=0, gid=0, fd=55,
     s=0xaf10ee84 "moh show classes") at cli.c:2388
#13 0x080ba9a4 in ast_cli_command_multiple_full (uid=0, gid=0, fd=55, 
size=17,
     s=0xaf10f0e8 "moh show classes") at cli.c:2411
#14 0x0807ce5c in netconsole (vconsole=0x822a054) at asterisk.c:1248
#15 0x08184091 in dummy_start (data=0xaf240030) at utils.c:971
---Type <return> to continue, or q <return> to quit---
#16 0xb736b585 in start_thread (arg=0xaf10fb70) at pthread_create.c:300
#17 0xb758a29e in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:130