[ASTERISK-169] stasis: Memory corruption in channel_snapshot_dialplan_create
This is the first time I've see this.
This happened when a channel that had been up for a few hours hang up, nothing unusual about it though.
Given the build of Asterisk on this system is almost two years old, this is just a note for reference unless this happens again with a newer build.
... (no log messages in more than a minute)
[2025-09-30 00:51:38.461] VERBOSE[3437615][C-000000eb]: pbx.c:2964 pbx_extension_helper: Executing [s@REDACTED:7] Hangup("PJSIP/outgoing-000000d1", "") in new stack
[2025-09-30 00:51:38.461] VERBOSE[3437615][C-000000eb]: pbx.c:4462 __ast_pbx_run: Spawn extension (REDACTED, s, 7) exited non-zero on 'PJSIP/outgoing-000000d1'
[2025-09-30 00:55:02.528] Asterisk 21.0.0 built by root @ ess on a x86_64 running Linux on 2023-10-26 22:56:31 UTC
Thread 1 (Thread 0x7f1d12f066c0 (LWP 3423332)):
#0 0x00005610fbb32451 in channel_snapshot_dialplan_create (chan=0x7f1d300b98c0) at stasis_channels.c:428
__res__ = 0
__d__ = 0x7f1d3cc58a80 <error: Cannot access memory at address 0x7f1d3cc58a80>
__p__ = 0x7f1d28030f50
target = 0x5610fbc38442 <__ast_string_field_empty_buffer+2> ""
__res__ = -1
__res__ = -1
snapshot = 0x7f1d28030f48
__PRETTY_FUNCTION__ = "channel_snapshot_dialplan_create"
#1 0x00005610fbb32f8e in ast_channel_snapshot_create (chan=0x7f1d300b98c0) at stasis_channels.c:531
old_snapshot = 0x5610fcd98aa8
snapshot = 0x7f1d28009c38
__PRETTY_FUNCTION__ = "ast_channel_snapshot_create"
#2 0x00005610fbb33308 in channel_snapshot_update_create (chan=0x7f1d300b98c0) at stasis_channels.c:582
update = 0x7f1d281ecdd8
__PRETTY_FUNCTION__ = "channel_snapshot_update_create"
#3 0x00005610fbb347a2 in ast_channel_publish_snapshot (chan=0x7f1d300b98c0) at stasis_channels.c:1073
update = 0x7f1d300b98c0
message = 0x7f1d300ba098
__PRETTY_FUNCTION__ = "ast_channel_publish_snapshot"
#4 0x00005610fbb34709 in ast_channel_stage_snapshot_done (chan=0x7f1d300b98c0) at stasis_channels.c:1051
#5 0x00005610fbae4251 in ast_rtp_instance_set_stats_vars (chan=0x7f1d300b98c0, instance=0x7f1d2807c6b0) at rtp_engine.c:2584
quality_buf = " minrxmes=085.367289; maxrxmes=085.367289; avgrxmes=085.367289; stdevrxmes=000.000319; mintxmes=000.000000; maxtxmes=000.000000; avgtxmes=000.000000; stdevtxmes=000.000000;V\300f\360\224"...
quality = 0x7f1d12f05ad0 " minrxmes=085.367289; maxrxmes=085.367289; avgrxmes=085.367289; stdevrxmes=000.000319; mintxmes=000.000000; maxtxmes=000.000000; avgtxmes=000.000000; stdevtxmes=000.000000;"
bridge = 0x0
__PRETTY_FUNCTION__ = "ast_rtp_instance_set_stats_vars"
#6 0x00007f1d1ce2dca2 in hangup (data=0x5610ff20d8b0) at chan_pjsip.c:2538
media = 0x7f1d2838f3d8
cause = 0
session = 0x7f1d348edc60
h_data = 0x5610ff20d8b0
ast = 0x7f1d300b98c0
channel = 0x7f1d30138fc0
__scope_level = 1
__FUNCTION__ = "hangup"
__PRETTY_FUNCTION__ = "hangup"
#7 0x00005610fbb4f042 in ast_taskprocessor_execute (tps=0x7f1d3427dbb0) at taskprocessor.c:1302
local = {local_data = 0x0, data = 0x5610fbb56578 <ast_threadstorage_set_ptr+60>}
t = 0x5610fedfa910
size = 139763405806512
__PRETTY_FUNCTION__ = "ast_taskprocessor_execute"
#8 0x00005610fbb5936b in execute_tasks (data=0x7f1d3427dbb0) at threadpool.c:1350
tps = 0x7f1d3427dbb0
#9 0x00005610fbb4f042 in ast_taskprocessor_execute (tps=0x5610fc5492b0) at taskprocessor.c:1302
local = {local_data = 0x7f1d12f05d00, data = 0x5610fc5464a8}
t = 0x5610fcaf0de0
size = 317742416
__PRETTY_FUNCTION__ = "ast_taskprocessor_execute"
#10 0x00005610fbb56dda in threadpool_execute (pool=0x5610fc5464c0) at threadpool.c:367
__PRETTY_FUNCTION__ = "threadpool_execute"
#11 0x00005610fbb58b22 in worker_active (worker=0x7f1d2c091450) at threadpool.c:1137
alive = 0
#12 0x00005610fbb58867 in worker_start (arg=0x7f1d2c091450) at threadpool.c:1056
worker = 0x7f1d2c091450
saved_state = (unknown: 0x5610)
__PRETTY_FUNCTION__ = "worker_start"
#13 0x00005610fbb63df2 in dummy_start (data=0x5610ff752680) at utils.c:1607
__cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {139762848523968, 2824591468790853076, -224, 0, 139763009173904, 139762848014336, 2824591468765687252, 8442319063477824980}, __mask_was_saved = 0}}, __pad = {0x7f1d12f05e70, 0x0, 0x7f1d1c83b990, 0x7f1d12e8a000}}
__cancel_routine = 0x5610fb9c2f87 <ast_unregister_thread>
__cancel_arg = 0x7f1d12f066c0
__not_first_call = 0
ret = 0x7f1d3005ce50
a = {start_routine = 0x5610fbb587bf <worker_start>, data = 0x7f1d2c091450, name = 0x7f1d2c046510 "worker_start started at [ 1111] threadpool.c worker_thread_start()"}
__PRETTY_FUNCTION__ = "dummy_start"
#14 0x00007f1d405c71f5 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
ret = <optimized out>
pd = <optimized out>
unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139762848523968, -2807762263333622316, -224, 0, 139763009173904, 139762848014336, 2824591468784561620, 2824411871013154260}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
not_first_call = <optimized out>
#15 0x00007f1d406478dc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
Comments
You must be logged in to leave a comment.