asterisk users - Jan 2005 - chan_iax2.c problem?

Hi,

I was messing around with FireFly last night and got asterisk to crash
hard. It looks like the bug is a division by zero in chan_iax2.c.
I reproduced it and here are some infos I got from gdb:

[Switching to Thread 245775 (LWP 23251)]
0x41154918 in calc_timestamp (p=0x816b710, ts=0, f=0x424eef24) at
chan_iax2.c:2896
2896                                    int diff = ms % (f->samples /
8);

(gdb) display f->samples
1: f->samples = 0

(gdb) backtrace
#0  0x41154918 in calc_timestamp (p=0x816b710, ts=0, f=0x424eef24) at
chan_iax2.c:2896
#1  0x41153119 in iax2_send (pvt=0x816b710, f=0x424eef24, ts=32,
seqno=-1, now=0, transfer=0, final=32) at chan_iax2.c:3091
#2  0x41166e17 in iax2_write (c=0x20, f=0x424eef24) at chan_iax2.c:3551
#3  0x0805cd41 in ast_write (chan=0x816bd90, fr=0x424eef24) at
channel.c:1634
#4  0x080610e3 in ast_activate_generator (chan=0x816bd90,
gen=0x407ca918,
params=0x20) at channel.c:1554
#5  0x407c725e in ast_moh_start (chan=0x0, class=0x20 <Address 0x20 out
of
bounds>) at res_musiconhold.c:598
#6  0x41804e3d in dial_exec (chan=0x816bd90, data=0x816bd90) at
app_dial.c:882
#7  0x08074a1f in pbx_exec (c=0x816bd90, app=0x8157770, data=0x424f1b24,
newstack=1) at pbx.c:469

I was calling Firefly's own extension from Firefly to test Busy() and
Playtones(busy) with Firefly. What happened was I got a socket error in
asterisk's console saying connection was refused from Firefly because
it's busy then this crash.

Simply setting diff = 0 if f->samples is 0 will prevent asterisk from
crashing but Firefly will crash to desktop instead. :s

Any ideas what this is all about?

Guills

On Jan 28, 2005, at 1:25 PM, Chamberland-Larose, Guillaume wrote:
> Hi,
>
> I was messing around with FireFly last night and got asterisk to crash
> hard. It looks like the bug is a division by zero in chan_iax2.c.
> I reproduced it and here are some infos I got from gdb:
>
> [Switching to Thread 245775 (LWP 23251)]
> 0x41154918 in calc_timestamp (p=0x816b710, ts=0, f=0x424eef24) at
> chan_iax2.c:2896
> 2896                                    int diff = ms % (f->samples /
> 8);
>
> (gdb) display f->samples
> 1: f->samples = 0
>
> (gdb) backtrace
> #0  0x41154918 in calc_timestamp (p=0x816b710, ts=0, f=0x424eef24) at
> chan_iax2.c:2896
> #1  0x41153119 in iax2_send (pvt=0x816b710, f=0x424eef24, ts=32,
> seqno=-1, now=0, transfer=0, final=32) at chan_iax2.c:3091
> #2  0x41166e17 in iax2_write (c=0x20, f=0x424eef24) at chan_iax2.c:3551
> #3  0x0805cd41 in ast_write (chan=0x816bd90, fr=0x424eef24) at
> channel.c:1634
> #4  0x080610e3 in ast_activate_generator (chan=0x816bd90,
> gen=0x407ca918,
> params=0x20) at channel.c:1554
> #5  0x407c725e in ast_moh_start (chan=0x0, class=0x20 <Address 0x20 out
> of
> bounds>) at res_musiconhold.c:598
> #6  0x41804e3d in dial_exec (chan=0x816bd90, data=0x816bd90) at
> app_dial.c:882
> #7  0x08074a1f in pbx_exec (c=0x816bd90, app=0x8157770, 
> data=0x424f1b24,
> newstack=1) at pbx.c:469
Looks like two bugs:

1) Apparently, asterisk's MOH is trying to send a zero-length voice 
frame out, (or maybe, it put data in the frame, but set samples to 
zero?).  It could also be a different bug in MOH.

2) The line of code upon which chan_iax2 crashed, I think is one I 
wrote :).  We should check for the zero case before trying to do this 
division.

Can you file a bug on this, at the bugtracker?  (2) should obviously be 
easy to fix as you saw.  (1) I'm not sure about.

Also, I'm CC'ing Adam Hart so he knows about the issue in Firefly; he 
may want to make it more robust to this..   (it probably receives a 
voice frame with no data in this case, which isn't meaningful, but 
shouldn't crash things..).

-SteveK



> I was calling Firefly's own extension from Firefly to test Busy() and
> Playtones(busy) with Firefly. What happened was I got a socket error in
> asterisk's console saying connection was refused from Firefly because
> it's busy then this crash.
>
> Simply setting diff = 0 if f->samples is 0 will prevent asterisk from
> crashing but Firefly will crash to desktop instead. :s
>
> Any ideas what this is all about?
>
> Guills
> _______________________________________________
> Asterisk-Users mailing list
> Asterisk-Users@lists.digium.com
> http://lists.digium.com/mailman/listinfo/asterisk-users
> To UNSUBSCRIBE or update options visit:
>    http://lists.digium.com/mailman/listinfo/asterisk-users
>

> -----Original Message-----
> From: Steve Kann [mailto:stevek@stevek.com] 
> Sent: Friday, January 28, 2005 12:08 PM
> To: Asterisk Users Mailing List - Non-Commercial Discussion
> Cc: Adam Hart
> Subject: Re: [Asterisk-Users] chan_iax2.c problem?
> Looks like two bugs:
> 
> 1) Apparently, asterisk's MOH is trying to send a zero-length 
> voice frame out, (or maybe, it put data in the frame, but set 
> samples to zero?).  It could also be a different bug in MOH.
> 
I'll take a better look at this tonight and file a bug for MOH if I can
find out what the issue is.
> 2) The line of code upon which chan_iax2 crashed, I think is 
> one I wrote :).  We should check for the zero case before 
> trying to do this division.
> 
> Can you file a bug on this, at the bugtracker?  (2) should 
> obviously be easy to fix as you saw.  (1) I'm not sure about.
I'll enter bug (2) in bugtracker right now.
> Also, I'm CC'ing Adam Hart so he knows about the issue in Firefly;
he
> may want to make it more robust to this..   (it probably receives a 
> voice frame with no data in this case, which isn't 
> meaningful, but shouldn't crash things..).
I should add, when asterisk crashes the way it did, Firefly thinks the
call is still in progress, it will only hang up when I tell it to.

Guills

We need to implement incoming call routing based on RDNIS and I would like 
to contract with someone who can set this up. We are forwarding calls to * 
using call forward no answer and call forward busy on the customers line and 
the RDNIS information is suppose to passed to *. I need to route the call to 
the proper voice mailbox based on that information.


If you can configure this for us please email me directly.



Thanks,



Gary Carr
President/CEO
705A Wesley Pines Rd.
COL Networks, Inc.
Lumberton, NC 28358
Phone: 910-402-5011
Fax: 910-618-9027
Check us out at: www.carolina.net