[asterisk-users] Any help Address 0xfffffffe out of bounds in app_confbridge.casterisk-11.5.1 using confbridge.conf

[hkc323]

Address 0xfffffffe out of bounds why and how to 
solve.MyConfbridgeCount(conferencenumber,variablename )return total number 
of user in conference given by conferencenumber otherwise zero.At runtime 
using MyConfbridgeCount(4000,count ).now app2: MyConfbridgeCount will call 
function count_exec(struct ast_channel *chan, const char *data).But at 
compile time char * data cause core dumped. Asterisk-11.5.1 Centos6 
app_confbrige.c confbridge.conf 
=====================================================
Task: Using Dailplan user want to retrive no of user in conference
'6050' => 1. Verbose(3,"testMyConfbridgeCount") [pbx_config] 2. 
MyConfbridgeCount(4000,count) [pbx_config] 3. verbose(3,"== ${count} ====") 
[pbx_config]

    issue:Currently asterisk core dumped as soon as app2 load . 
    file: app/app_confbrige.c
    =====================================================================
    partial code of app_confbridge.c:
    ====================================================================
    static const char *const app2 ="MyConfbridgeCount";

    static int load_module(void)
    {
            ast_verb(3 ,"==Inside load_module==");
        ast_verb(3 ,"\n ==Inside load_module==\n ");
            ast_log(LOG_NOTICE ,"\n ==Inside load_module==\n ");


            //tes4
            //const char *data= (char*)malloc(sizeof(char) * 256);
            char *sdata="4000,acPd";
            ast_verb(3 ,"\n ==Inside load_module  sdata [%s] at [%p] 
len[%d]\n ",sdata,&sdata,strlen(sdata));
            ast_log(LOG_NOTICE ,"\n ==Inside load_module  sdata [%s] at [%p] 
and len[%d]\n ",sdata,&sdata,strlen(sdata));


            char *data= malloc(sizeof(char) * 256);
            data=ast_strdupa(sdata);
            ast_verb(3 ,"\n ==Inside load_module  data is [%s] at [%p] 
len[%d]\n ",data,&data,strlen(data));

            ast_log(LOG_NOTICE ,"\n ==Inside load_module  data is  [%s] at 
[%p] and len[%d]\n ",data,&data,strlen(data));

            ast_verb(3 ,"\n==Inside load_module  data malloc == \n" );
            ast_log(LOG_NOTICE,"\n==Inside load_module  data malloc == \n" 
);


     res |= ast_register_application_xml(app2,count_exec);
        return res;
    }
    static int unload_module(void)
    {

       res |= ast_unregister_application(app2);
        return res;
    }

    static struct ast_cli_entry cli_confbridge[] = {
      AST_CLI_DEFINE(count_exec, "MyConfbrigdeCount Show Number of 
adminUser(s) in Conference." ),
    }

    static int count_exec(struct ast_channel *chan, const char *data)
    {
            int res = 0;
            struct conference_bridge *conf=NULL;
            int count;
            char *localdata;
            char val[80] = "0";

            struct ao2_iterator i;
            struct conference_bridge tmp;


            AST_DECLARE_APP_ARGS(args,
                    AST_APP_ARG(confno);
                    AST_APP_ARG(varname);
            );



            ast_verb(3,"\n============Inside count_exec =============\n");

            ast_verb(3,"\n = 0xfffffffe inside count_exec == data[%s] at add 
:[%p] ,len:[%d] ====\n",data,&data,strlen(data));



        return res; 
    }
    ===================================================================
    (gdb) bt
    #0  __strlen_sse2_bsf () at ../sysdeps/i386/i686/multiarch/strlen-sse2-
bsf.S:64
    #1  0x00cefa49 in count_exec (chan=0xd09d78, data=0xfffffffe <Address 
0xfffffffe out of bounds>) at app_confbridge.c:2438
    #2  0x080d40eb in __ast_cli_register (e=0xd09d78, ed=0x0) at cli.c:2118
    #3  0x080d4459 in ast_cli_register (e=0xd09d78) at cli.c:2178
    #4  0x080d4482 in ast_cli_register_multiple (e=0xd09900, len=13) at 
cli.c:2189
    #5  0x00cf8030 in load_module () at app_confbridge.c:4779
    #6  0x0812ba89 in start_resource (mod=0x905e740) at loader.c:845
    #7  0x0812c45c in load_resource_list (load_order=0xbfdbb8b0, 
global_symbols=0, mod_count=0xbfdbb8a8) at loader.c:1045
    #8  0x0812ca5a in load_modules (preload_only=0) at loader.c:1198
    #9  0x080895f7 in main (argc=4, argv=0xbfdbcdc4) at asterisk.c:4180
    (gdb) frame 1
    #1  0x00cefa49 in count_exec (chan=0xd09d78, data=0xfffffffe <Address 
0xfffffffe out of bounds>) at app_confbridge.c:2438
    2438        ast_verb(3,"\n = 0xfffffffe inside count_exec == data add 
:%p ,len:%d ====\n",&data,strlen(data));
    ========================================================================