asterisk users - Aug 2007 - 1.4.10.[0,1] crashes when call parked

100% repeatable (for me). 

Sip phone A calls Sip phone B. 

Either Sip phone A or B does #700.  The party that keyed #700 gets the
parked announcement (eg 701) and the other party get MOH.  There is
still an audio channel between the two SIP phones at this point.

When the party that typed #700 hangs up, Asterisk crashes. 

This has been working in previous 1.4's (but not 1.4.10) and I havn't
changed my parking config.

Here's what comes up on the console as it crashes. 

-- <SIP/Testsnom-00709570> Playing 'digits/7' (language
'en')
 -- <SIP/Testsnom-00709570> Playing 'digits/0' (language
'en')
 -- <SIP/Testsnom-00709570> Playing 'digits/1' (language
'en')
 -- Added extension '701' priority 1 to parkedcalls 
 -- Stopped music on hold on SIP/115-0072f7a0 
 == SIP/115-0072f7a0 got tired of being parked 
 == Spawn extension (macro-stdsip, s, 6) exited non-zero on
'SIP/Testsnom-00709570' in macro 'stdsip'
 == Spawn extension (macro-stdsip, s, 6) exited non-zero on
'SIP/Testsnom-00709570'
*** glibc detected *** asterisk: double free or corruption (out):
0x00002ab23a7ed9f0 ***
======= Backtrace: ========= 
/lib/libc.so.6[0x2ab23a620733] 
/lib/libc.so.6(__libc_free+0x84)[0x2ab23a6208b4] 
asterisk(ast_channel_free+0xf6)[0x438fa6] 
asterisk(ast_hangup+0x35a)[0x43b84a] 
/usr/lib/asterisk/modules/res_features.so[0x2aaaab8298c0] 
asterisk[0x4a719c] 
/lib/libpthread.so.0[0x2ab239da23ca] 
/lib/libc.so.6(__clone+0x6d)[0x2ab23a67f55d] 
======= Memory map: =======
Anyone got any ideas?

-- 
 Regards,
     Russell
 --------------------------------------------------------------------
| Russell Brown          | MAIL: russell at lls.com PHONE: 01780 471800 |
| Lady Lodge Systems     | WWW Work: http://www.lls.com              |
| Peterborough, England  | WWW Play: http://www.ruffle.me.uk         |
 --------------------------------------------------------------------

Russell Brown wrote:
> 100% repeatable (for me). 
> 
> Sip phone A calls Sip phone B. 
> 
> Either Sip phone A or B does #700.  The party that keyed #700 gets the
> parked announcement (eg 701) and the other party get MOH.  There is
> still an audio channel between the two SIP phones at this point.
> 
> When the party that typed #700 hangs up, Asterisk crashes. 
> 
> This has been working in previous 1.4's (but not 1.4.10) and I
havn't
> changed my parking config.
> 
> Here's what comes up on the console as it crashes. 
> 
> -- <SIP/Testsnom-00709570> Playing 'digits/7' (language
'en')
>  -- <SIP/Testsnom-00709570> Playing 'digits/0' (language
'en')
>  -- <SIP/Testsnom-00709570> Playing 'digits/1' (language
'en')
>  -- Added extension '701' priority 1 to parkedcalls 
>  -- Stopped music on hold on SIP/115-0072f7a0 
>  == SIP/115-0072f7a0 got tired of being parked 
>  == Spawn extension (macro-stdsip, s, 6) exited non-zero on
'SIP/Testsnom-00709570' in macro 'stdsip'
>  == Spawn extension (macro-stdsip, s, 6) exited non-zero on
'SIP/Testsnom-00709570'
> *** glibc detected *** asterisk: double free or corruption (out):
0x00002ab23a7ed9f0 ***
> ======= Backtrace: ========= 
> /lib/libc.so.6[0x2ab23a620733] 
> /lib/libc.so.6(__libc_free+0x84)[0x2ab23a6208b4] 
> asterisk(ast_channel_free+0xf6)[0x438fa6] 
> asterisk(ast_hangup+0x35a)[0x43b84a] 
> /usr/lib/asterisk/modules/res_features.so[0x2aaaab8298c0] 
> asterisk[0x4a719c] 
> /lib/libpthread.so.0[0x2ab239da23ca] 
> /lib/libc.so.6(__clone+0x6d)[0x2ab23a67f55d] 
> ======= Memory map: =======> 
> Anyone got any ideas?
> 
No ideas but I also found something last night that could be related. I 
have the following:

Home SIP   <-SIP->  Home Asterisk <-IAX-> Work Asterisk

Calls from Home SIP to Home Asterisk (like vms) sound fine. Calls from 
Home SIP through Home Asterisk to Work Asterisk sound horrible on the 
SIP side. I don't know how it sounded on the Work side since I was 
checking voicemail. It occurred on every call all the time with 1.4.10 
and 1.4.10.1. Reverting Home Asterisk to 1.4.9 solved the problem.

Maybe something got "fixed" in chan_sip in 1.4.10?

-Dave