[Asterisk-Dev] reproducable segfault on call-transfer

[Guenther Starnberger]

Hello,

When using Asterisk with transfers i'm able to reproduce a problem were the
transfer does cause a segfault.

The only entry in the used context looks as follows:

exten =>
_.,1,Python(incoming_sip_dial,${EXTEN},${SIPDOMAIN},${SIP_HEADER(Proxy-Authorization)},proxy)

The Python App is part of the PyAstre module - because of the backtrace I
don't think that PyAstre is responsible for the problem.

I can reproduce the problem by doing the following: A calls B. B puts A on
hold and calls C. B transfers A to C. Segfault.

A is a Sipura ATA (1001), B is a IntelliTouch ITC-3002 and C is a Sipura
SPA-841. I'm currently only able to reproduce the segfault when calling in
this combination.

GDB shows this information:
------ 8< ------ 8< ------ 8< ------ 8< ------
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 524320 (LWP 9238)]
0x409b0776 in __get_header (req=0x17cc, name=0xbbbf64b7
"Proxy-Authorization", start=0xbbbf645c)
    at chan_sip.c:2517
2517    {
(gdb)
------ 8< ------ 8< ------ 8< ------ 8< ------
    
The backtrace:
------ 8< ------ 8< ------ 8< ------ 8< ------
#0  0x408b0776 in __get_header (req=0x17cc, name=0xbd9f64b7
  "Proxy-Authorization", start=0xbd9f645c)
  at chan_sip.c:2517
#1  0x408b0915 in get_header (req=0xbd9f645c, name=0xbd9f645c "") at
  chan_sip.c:2568
#2  0x408c1dac in func_header_read (chan=0x821b1b0, cmd=0xbd9f64ac
  "SIP_HEADER",
  data=0xbd9f64b7 "Proxy-Authorization", buf=0xbd9f8514 "",
  len=3181339740) at chan_sip.c:8108
#3  0x08080419 in ast_func_read (chan=0xbd9f645c, in=0xbd9f64b7
  "Proxy-Authorization",
  workspace=0xbd9f645c "", len=3181339740) at pbx.c:1328
#4  0x08088901 in pbx_substitute_variables_helper_full (c=0x821b1b0,
  cp1=0x8178960
  "incoming_sip_dial|${EXTEN}|${SIPDOMAIN}|${SIP_HEADER(Proxy-Authorization)}|proxy",
  cp2=0xbd9fd739 "", count=8170, headp=0x0) at pbx.c:1466
#5  0x080806cd in pbx_substitute_variables_helper (c=0xbd9f645c,
  cp1=0xbd9f645c "", cp2=0xbd9f645c "",
  count=-1113627556) at pbx.c:1547
#6  0x08088e33 in pbx_extension_helper (c=0x821b1b0, con=0xbd9f645c,
  context=0x821b300 "incoming-sip",
  exten=0x821b3f4 "h", priority=1, label=0x0, callerid=0x81789ec "Python",
  action=135389408)
  at pbx.c:1623
#7  0x08089c86 in __ast_pbx_run (c=0x821b1b0) at pbx.c:2234
#8  0x0808a5d8 in pbx_thread (data=0x821b1b0) at pbx.c:2521
#9  0x40026e51 in pthread_start_thread () from /lib/libpthread.so.0
#10 0x40026ecf in pthread_start_thread_event () from /lib/libpthread.so.0
#11 0x402f792a in clone () from /lib/libc.so.6
------ 8< ------ 8< ------ 8< ------ 8< ------
    
I am using a CVS checkout from Jul 13. I noticed that in my CDRs the
Proxy-Auth argument to the Dial Cmd is truncated (but it seems that my App
is able to access the whole string nevertheless).

Do you need any further debugging information?

Regards,
Guenther Starnberger