asterisk users - Dec 2005 - Core dumps since 1.2.0

Hi,
Ever since upgrading to 1.2.0, Asterisk occasionally core dumps. I'm
currently on 1.2.1 with the same problem.
It crashes when an incoming call (zap) dials an extension. It will ring the
extension short, then crash.

Here is the backtrace:
#0  0x40187e06 in mallopt () from /lib/libc.so.6
(gdb) backtrace
#0  0x40187e06 in mallopt () from /lib/libc.so.6
#1  0x40186fb3 in malloc () from /lib/libc.so.6
#2  0x4018ba60 in strdup () from /lib/libc.so.6
#3  0x0805777a in ast_verbose (fmt=0x40246300 "") at logger.c:886
#4  0x4069edc6 in skinny_call (ast=0x8189250, dest=0x49445554 <Address
0x49445554 out of bounds>, timeout=0) at chan_skinny.c:1980
#5  0x080631e0 in ast_call (chan=0x8189250, addr=0x49445554 <Address
0x49445554 out of bounds>, timeout=1229215060) at channel.c:2547
#6  0x407a6afe in dial_exec_full (chan=0x81879d0, data=0x8189250,
peerflags=0xbd5f900c) at app_dial.c:1102
#7  0x407a3dc5 in dial_exec (chan=0x49445554, data=0x49445554) at
app_dial.c:1600
#8  0x0808dfa5 in pbx_extension_helper (c=0x81879d0, con=0x49445554,
context=0x8187b20 "menu-bell", exten=0x8187c14 "2",
priority=2, label=0x0,
    callerid=0x0, action=0) at pbx.c:544
#9  0x0808eb4a in __ast_pbx_run (c=0x81879d0) at pbx.c:2220
#10 0x0808c7b4 in ast_pbx_run (c=0x81879d0) at pbx.c:2546
#11 0x406c7417 in ss_thread (data=0x81879d0) at chan_zap.c:6132
#12 0x40025e51 in pthread_start_thread () from /lib/libpthread.so.0
#13 0x401ed92a in clone () from /lib/libc.so.6

Any ideas are welcome.
Thanks in advance,
-Ry
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
http://lists.digium.com/pipermail/asterisk-users/attachments/20051208/009e38b2/attachment.htm

In article <67bbf1700512081901q6f19b299mbaafed1ca9984cec@mail.gmail.com>,
Ryan Laginski <eulake@gmail.com> wrote:
> -=-=-=-=-=-
> -=-=-=-=-=-
> 
> Hi,
> Ever since upgrading to 1.2.0, Asterisk occasionally core dumps. I'm
> currently on 1.2.1 with the same problem.
> It crashes when an incoming call (zap) dials an extension. It will ring the
> extension short, then crash.
> 
> Here is the backtrace:
> #0  0x40187e06 in mallopt () from /lib/libc.so.6
> (gdb) backtrace
> #0  0x40187e06 in mallopt () from /lib/libc.so.6
> #1  0x40186fb3 in malloc () from /lib/libc.so.6
> #2  0x4018ba60 in strdup () from /lib/libc.so.6
> #3  0x0805777a in ast_verbose (fmt=0x40246300 "") at logger.c:886
> #4  0x4069edc6 in skinny_call (ast=0x8189250, dest=0x49445554 <Address
> 0x49445554 out of bounds>, timeout=0) at chan_skinny.c:1980
> #5  0x080631e0 in ast_call (chan=0x8189250, addr=0x49445554 <Address
> 0x49445554 out of bounds>, timeout=1229215060) at channel.c:2547
> #6  0x407a6afe in dial_exec_full (chan=0x81879d0, data=0x8189250,
> peerflags=0xbd5f900c) at app_dial.c:1102
> #7  0x407a3dc5 in dial_exec (chan=0x49445554, data=0x49445554) at
> app_dial.c:1600
> #8  0x0808dfa5 in pbx_extension_helper (c=0x81879d0, con=0x49445554,
> context=0x8187b20 "menu-bell", exten=0x8187c14 "2",
priority=2, label=0x0,
>     callerid=0x0, action=0) at pbx.c:544
That looks like something is overflowing a text buffer. The address
0x49445554 appears to be a pointer that was overwritten with 'TUDI'.
> #9  0x0808eb4a in __ast_pbx_run (c=0x81879d0) at pbx.c:2220
> #10 0x0808c7b4 in ast_pbx_run (c=0x81879d0) at pbx.c:2546
> #11 0x406c7417 in ss_thread (data=0x81879d0) at chan_zap.c:6132
> #12 0x40025e51 in pthread_start_thread () from /lib/libpthread.so.0
> #13 0x401ed92a in clone () from /lib/libc.so.6
> 
> Any ideas are welcome.
The first place I would look is in__ast_pbx_run(),and after that, in
pbx_extension_helper(). But it could be anywhere.

Cheers
Tony
-- 
Tony Mountifield
Work: tony@softins.co.uk - http://www.softins.co.uk
Play: tony@mountifield.org - http://tony.mountifield.org