Address 0xfffffffe out of bounds
why and how to solve.
MyConfbridgeCount(conferencenumber, variablename)
returns the total number of users in a conference given by conferencenumber, otherwise it returns zero. At runtime, I'm using MyConfbridgeCount(4000,count).
Now app2: MyConfbridgeCount
will call the function count_exec(struct ast_channel *chan, const char *data)
. But at compile time char * data
caused a core dump.
Asterisk-11.5.1 Centos6 app_confbrige.c confbridge.conf** ======================================================================
Task: Using Dailplan user want to retrive no of user in conference '6050' => 1. Verbose(3,"testMyConfbridgeCount") [pbx_config] 2. MyConfbridgeCount(4000,count) [pbx_config] 3. verbose(3,"== ${count} ====") [pbx_config]
The issue: Currently asterisk core dumped as soon as app2 loads:
(gdb) bt
#0 __strlen_sse2_bsf () at ../sysdeps/i386/i686/multiarch/strlen-sse2-bsf.S:64
#1 0x00cefa49 in count_exec (chan=0xd09d78, data=0xfffffffe <Address 0xfffffffe out of bounds>) at app_confbridge.c:2438
#2 0x080d40eb in __ast_cli_register (e=0xd09d78, ed=0x0) at cli.c:2118
#3 0x080d4459 in ast_cli_register (e=0xd09d78) at cli.c:2178
#4 0x080d4482 in ast_cli_register_multiple (e=0xd09900, len=13) at cli.c:2189
#5 0x00cf8030 in load_module () at app_confbridge.c:4779
#6 0x0812ba89 in start_resource (mod=0x905e740) at loader.c:845
#7 0x0812c45c in load_resource_list (load_order=0xbfdbb8b0, global_symbols=0, mod_count=0xbfdbb8a8) at loader.c:1045
#8 0x0812ca5a in load_modules (preload_only=0) at loader.c:1198
#9 0x080895f7 in main (argc=4, argv=0xbfdbcdc4) at asterisk.c:4180
(gdb) frame 1
#1 0x00cefa49 in count_exec (chan=0xd09d78, data=0xfffffffe <Address 0xfffffffe out of bounds>) at app_confbridge.c:2438
2438 ast_verb(3,"\n = 0xfffffffe inside count_exec == data add :%p ,len:%d ====\n",&data,strlen(data));
Here's the relevant code from app/app_confbridge.c
:
static const char *const app2 ="MyConfbridgeCount";
static int load_module(void) {
ast_verb(3 ,"==Inside load_module==");
ast_verb(3 ,"\n ==Inside load_module==\n ");
ast_log(LOG_NOTICE ,"\n ==Inside load_module==\n ");
//tes4
//const char *data= (char*)malloc(sizeof(char) * 256);
char *sdata="4000,acPd";
ast_verb(3 ,"\n ==Inside load_module sdata [%s] at [%p] len[%d]\n ",sdata,&sdata,strlen(sdata));
ast_log(LOG_NOTICE ,"\n ==Inside load_module sdata [%s] at [%p] and len[%d]\n ",sdata,&sdata,strlen(sdata));
char *data= malloc(sizeof(char) * 256);
data=ast_strdupa(sdata);
ast_verb(3 ,"\n ==Inside load_module data is [%s] at [%p] len[%d]\n ",data,&data,strlen(data));
ast_log(LOG_NOTICE ,"\n ==Inside load_module data is [%s] at [%p] and len[%d]\n ",data,&data,strlen(data));
ast_verb(3 ,"\n==Inside load_module data malloc == \n" );
ast_log(LOG_NOTICE,"\n==Inside load_module data malloc == \n" );
res |= ast_register_application_xml(app2,count_exec);
return res;
}
static int unload_module(void) {
res |= ast_unregister_application(app2);
return res;
}
static struct ast_cli_entry cli_confbridge[] = { AST_CLI_DEFINE(count_exec, "MyConfbrigdeCount Show Number of adminUser(s) in Conference." ),
}
static int count_exec(struct ast_channel *chan, const char *data) {
int res = 0;
struct conference_bridge *conf=NULL;
int count;
char *localdata;
char val[80] = "0";
struct ao2_iterator i;
struct conference_bridge tmp;
AST_DECLARE_APP_ARGS(args,
AST_APP_ARG(confno);
AST_APP_ARG(varname);
);
ast_verb(3,"\n============Inside count_exec =============\n");
ast_verb(3,"\n = 0xfffffffe inside count_exec == data[%s] at add :[%p] ,len:[%d] ====\n",data,&data,strlen(data));
return res;
}
i changed in file app_confbridge.c (1)in func count_exect use ,&data in stand of data .(2) put comment in func static struct ast_cli_entry cli_confbridge[] //AST_CLI_DEFINE(count_exec, "SabseConfbridgeCount Show Number of User(s) in Conference." ), now no more crash core dumped .
I don't know the asterisk API which you are using but apparently the error happens when the library calls your count_exec function on loading the module, after you registered the function with ast_register_application_xml(). Obviously the pointer is invalid so that the dereferencing happening in strlen() dumps.
My guess is that some value hasn't been properly initialized when setting up the application, or perhaps a parameter hasn't been supplied or has been supplied in the wrong order, or an address operator has been forgotten (0xfffffffe is -2 which sounds like a legit value of a variable).
User contributions licensed under CC BY-SA 3.0