chan_capi caused segmentation fault in asterisk

[Andreas Longwitz]

Hi Hans,

I run asterisk and chan_capi latest version from your git repository.
After upgrading my production PBX server from FreeBSD 8 to FreeBSD 10
Stable I saw some cores of asterisk, they all looked like this:

Core was generated by `/usr/local/sbin/asterisk -n -F -U asterisk'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x28782f9d in strlen () from /lib/libc.so.7
[Current thread is 1 (Thread 29c55800 (LWP 100447))]
(gdb) where
#0  0x28782f9d in strlen () from /lib/libc.so.7
#1  0x28777f5d in __vfprintf () from /lib/libc.so.7
#2  0x286b369e in vsnprintf () from /lib/libc.so.7
#3  0x081a40dc in __ast_string_field_ptr_build_va (mgr=0x290719b0,
pool_head=0x2907197c, ptr=0x29071980, format=0x28972e9e "CAPI/%s/%s-free",
    ap1=0xbb733ce0 "\v", ap2=0xbb733ce0 "\v") at utils.c:1968
#4  0x080a8d4f in __ast_channel_alloc_ap (needqueue=0, state=0,
cid_num=0x0, cid_name=0x0, acctcode=0x0, exten=0x0, context=0x0,
linkedid=0x0,
    amaflag=0, file=0x2896e23d "chan_capi.c", line=2023,
function=0x28972e89 "cd_alloc_pbx_channel", name_fmt=0x28972e9e
"CAPI/%s/%s-free",
    ap1=0xbb733ce0 "\v", ap2=0xbb733ce0 "\v") at channel.c:1273
#5  0x080a96e6 in __ast_channel_alloc (needqueue=0, state=0,
cid_num=0x0, cid_name=0x0, acctcode=0x0, exten=0x0, context=0x0,
linkedid=0x0,
    amaflag=0, file=0x2896e23d "chan_capi.c", line=2023,
function=0x28972e89 "cd_alloc_pbx_channel", name_fmt=0x28972e9e
"CAPI/%s/%s-free")
    at channel.c:1378
#6  0x2894f2f2 in cd_alloc_pbx_channel (name=0xb <error: Cannot access
memory at address 0xb>, dest=0xbb733e4e "4982892") at chan_capi.c:2022
#7  0x2893df39 in chan_capi_request (type=0xbb734990 "CAPI", format=8,
requestor=0x2a45ad1c, data=0xbb7351a4, cause=0xbb734bcc)
    at chan_capi.c:3485
#8  0x080b620f in ast_request (type=0xbb734990 "CAPI", format=8,
requestor=0x2a45ad1c, data=0xbb7351a4, cause=0xbb734bcc) at channel.c:5740
#9  0x28ab0328 in dial_exec_full (chan=0x2a45ad1c, data=0xbb735cdc
"CAPI/ISDN_NT_EUMEX/4982892", peerflags=0xbb7358e8, continue_exec=0x0)
    at app_dial.c:2342
#10 0x28ab5050 in dial_exec (chan=0x2a45ad1c, data=0xbb735cdc
"CAPI/ISDN_NT_EUMEX/4982892") at app_dial.c:3061
#11 0x0813cfff in pbx_exec (c=0x2a45ad1c, app=0x2a807800,
data=0xbb735cdc "CAPI/ISDN_NT_EUMEX/4982892") at pbx.c:1479
#12 0x081468c5 in pbx_extension_helper (c=0x2a45ad1c, con=0x0,
context=0x2a45b088 "capi_to_eumex", exten=0x2a45b0d8 "4982892", priority=1,
    label=0x0, callerid=0x2a429a90 "039831429096", action=E_SPAWN,
found=0xbb739d70, combined_find_spawn=1) at pbx.c:4739
#13 0x081484f8 in ast_spawn_extension (c=0x2a45ad1c, context=0x2a45b088
"capi_to_eumex", exten=0x2a45b0d8 "4982892", priority=1,
    callerid=0x2a429a90 "039831429096", found=0xbb739d70,
combined_find_spawn=1) at pbx.c:5381
#14 0x08148eb5 in __ast_pbx_run (c=0x2a45ad1c, args=0x0) at pbx.c:5484
#15 0x0814a9b5 in pbx_thread (data=0x2a45ad1c) at pbx.c:5825
#16 0x081a29c6 in dummy_start (data=0x2a429aa0) at utils.c:1173

(gdb) f 7
#7  0x2893df39 in chan_capi_request (type=0xbb734990 "CAPI", format=8,
requestor=0x2a45ad1c, data=0xbb7351a4, cause=0xbb734bcc)
    at chan_capi.c:3485
3485            pbx_chan = cd_alloc_pbx_channel(cep->name, dest);
(gdb) list
3480
3481            /*
3482             * Allocate a PBX channel before allocating the CAPI
channel,
3483             * while unlocked:
3484             */
3485            pbx_chan = cd_alloc_pbx_channel(cep->name, dest);
3486
3487            /* have to lock the CAPI application first! */
3488
3489            cc_mutex_lock(&p_app->lock);
3490
3491            cep = cep_root_acquire();

So the core happens when cd_alloc_pbx_channel is called with parameter
cep->name, because cep is not allocated at this time (first two lines
later). After changing this call to
            pbx_chan = cd_alloc_pbx_channel("cep_name", dest)
no dumps anymore.

I think you will have a better solution for this.


Andreas