[Asterisk-Users] capi segfault when incoming call is answered

[Thomas Andrews]

I have a Fritz! card set up to use capi, however when incoming calls to
the card are answered, asterisk segfaults. Here is the output of gdb:

#0  0x4014f7af in memcpy () from /lib/tls/libc.so.6
#1  0x081316b0 in ?? ()
#2  0x08130680 in ?? ()
#3  0x40432da6 in pipe_msg (PLCI=257, CMSG=0x405052c0) at chan_capi.c:1560
#4  0x40436f90 in capi_handle_msg (CMSG=0x101) at chan_capi.c:2379
#5  0x404362f7 in do_monitor (data=0x0) at chan_capi.c:2404
#6  0x400229b4 in start_thread () from /lib/tls/libpthread.so.0
#7  0x00000000 in ?? ()

The problem is at line 1560 in chan_capi.c:

    memcpy(&b3buf[AST_FRIENDLY_OFFSET],(char *)DATA_B3_IND_DATA(CMSG),DATA_B3_IND_DATALENGTH(CMSG));

I'm using chan_capi-0.3.5 with the patch from
    http://www.levigo.de/VoIP/chan_capi-0.3.5-cvs-HEAD-patch.tar.bz2

(A similar thing happens when I make outgoing calls via the Fritz! card
- it segfaults as soon as the phone on the other end starts ringing)

Here's a bit more info from gdb:

8<-----------------------------8<-------------------------------8<------------------------------

#0  0x4014f7af in memcpy () from /lib/tls/libc.so.6
No symbol table info available.
#1  0x081316b0 in ?? ()
No symbol table info available.
#2  0x08130680 in ?? ()
No symbol table info available.
#3  0x40432da6 in pipe_msg (PLCI=257, CMSG=0x405052c0) at
chan_capi.c:1560
        p = (struct capi_pipe *) 0x1e
        CMSG2 = {ApplId = 1, Command = 131 '\203', Subcommand = 131
'\203', Messagenumber = 202, adr = {adrController = 131585, 
    adrPLCI = 131585, adrNCCI = 131585}, AdditionalInfo = CAPI_COMPOSE,
B1configuration = 0x0, B1protocol = 0, B2configuration = 0x0, 
  B2protocol = 0, B3configuration = 0x0, B3protocol = 0, BC = 0x0,
BChannelinformation = 0x0, BProtocol = CAPI_COMPOSE, 
  CalledPartyNumber = 0x0, CalledPartySubaddress = 0x0,
CallingPartyNumber = 0x0, CallingPartySubaddress = 0x0, CIPmask = 0, 
  CIPmask2 = 0, CIPValue = 0, Class = 0, ConnectedNumber = 0x0,
ConnectedSubaddress = 0x0, Data32 = 0, Data64 = 0, DataHandle = 0, 
  DataLength = 0, FacilityConfirmationParameter = 0x0, Facilitydataarray
= 0x0, FacilityIndicationParameter = 0x0, 
  FacilityRequestParameter = 0x0, FacilityResponseParameters = 0x0,
FacilitySelector = 0, Flags = 0, Function = 0, HLC = 0x0, Info = 0, 
  InfoElement = 0x0, InfoMask = 0, InfoNumber = 0, Keypadfacility = 0x0,
LLC = 0x0, ManuData = 0x0, ManuID = 0, NCPI = 0x0, Reason = 0, 
  Reason_B3 = 0, Reject = 0, Useruserdata = 0x0, SendingComplete = 0x0,
Data = 0xc <Address 0xc out of bounds>, l = 1, p = 1078220081, 
  par = 0x40449700 "\f", m = 0x0, buf = '\0' <repeats 179 times>}
        error = 160
        fr = {frametype = 4, subclass = 4, datalen = 0, samples = 128,
mallocd = 192, offset = 0, src = 0x4020aebc "Ä}\023", data = 0x41, 
  delivery = {tv_sec = 135278508, tv_usec = 135457433}, prev =
0x818b820, next = 0x1}
        b3buf = "H¢C@\n\000\000\000ÿÿÿÿ", '\0' <repeats 36 times>,
"Ðð\017 at TZ\000\000xûÿ¿\000\000\000\000¼®
@\t\000\000\0000VP at HSP@\017\234\026@ý»\037@", '\0' <repeats 16 times>,
"N¢C@", '\0' <repeats 60 times>, "\n¼\037@", '\0' <repeats 16 times>,
"¼® @\2048\024 at 0VP@\bVP@¼® @`UP@/N\024@\224SP@`U40¯UP@\000\000\000\000¼®
@\224SP@¬TP at P\000\000\000\036å\023@\224SP@Ï\232\016\bÈTP@`UP@\000\000\000\0004TP@\001\200­û`UP@`UP@"...
        j = 30
        b3len = 0
        dtmf = 30 '\036'
        dtmflen = 1079005888
        rxavg = 0
        txavg = 0

8<-----------------------------8<-------------------------------8<------------------------------