Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[bug]: app_voicemail: Multiple executions of unit tests cause segfault #629

Description

@InterLinked1

Severity

Minor

Versions

21.0.0

Components/Modules

app_voicemail

Operating Environment

Debian 12

Frequency of Occurrence

Constant

Issue Description

If you run test execute category /apps/app_voicemail/ and then run test execute category /apps/app_voicemail/ again, Asterisk will segfault.

The cause is consistent, an attempt to call ast_copy_string on NULL in the test_voicemail_vm_info unit test:

#1  0x00007f87680449d8 in acf_vm_info (chan=0x7f8734166600, cmd=0x7f8762a0928e "VM_INFO", args=0x7f8762a09080 "00000000@test,email", buf=0x7f8762a09180 "", len=256) at app_voicemail.c:13164
#2  0x00007f876804eb3b in test_voicemail_vm_info (info=0x56485a20b7f0, cmd=TEST_EXECUTE, test=0x56485a20b7f0) at app_voicemail.c:15683

Technically, this could happen since we do not check if allocation fails:

vmu->email = ast_strdup("[email protected]");

However, that is not what's happening here, and this happens regardless of whether the executions are concurrent or sequential. It seems that the tests (as a whole, not this specific one per se) do not clean up properly after themselves, as running the test wipes my current voicemail users and leaves the system in this state:

debian*CLI> voicemail show users
Context    Mbox  User                      Zone       NewMsg
test       00000002 Mrs. Test                 european        0
test       00000000                                           0
2 voicemail users configured.

Therefore, the next time the tests are running, I'm guessing that vmu->email is NULL for something that was created and left behind by the test, causing VM_INFO to try to copy vmu->email when it's NULL. I narrowed this down to test execute category /apps/app_voicemail/ name test_voicemail_msgcount specifically as an offending test,.

Running module refresh app_voicemail between test executions prevents the SEGV, since the bad state is cleaned up when the module is discarded and loaded again (until the tests are run again).

The underlying root cause is the tests are not cleaning up properly and restoring the original state.

Relevant log output

Thread 1 (Thread 0x7f8762a0a6c0 (LWP 2071219)):
#0  0x00007f87680204d9 in ast_copy_string (dst=0x7f8762a09180 "", src=0x0, size=256) at /usr/src/asterisk-21.0.0/include/asterisk/strings.h:412
        sz = 256
        sp = 0x0
#1  0x00007f87680449d8 in acf_vm_info (chan=0x7f8734166600, cmd=0x7f8762a0928e "VM_INFO", args=0x7f8762a09080 "00000000@test,email", buf=0x7f8762a09180 "", len=256) at app_voicemail.c:13164
        svm = {context = "test", '' <repeats 75 times>, mailbox = "00000000", '' <repeats 71 times>, password = '' <repeats 79 times>, fullname = '' <repeats 79 times>, email = 0x0, emailsubject = 0x0, emailbody = 0x0, pager = '' <repeats 79 times>, serveremail = '' <repeats 79 times>, fromstring = '' <repeats 99 times>, language = '' <repeats 39 times>, zonetag = '' <repeats 79 times>, locale = '' <repeats 19 times>, callback = '' <repeats 79 times>, dialout = '' <repeats 79 times>, uniqueid = '' <repeats 79 times>, exit = '' <repeats 79 times>, attachfmt = '' <repeats 19 times>, flags = 0, saydurationm = 0, minsecs = 0, maxmsg = 0, maxdeletedmsg = 0, maxsecs = 0, passwordlocation = 0, volgain = 0, list = {next = 0x0}}
        vmu = 0x7f8762a08a40
        parse = 0x7f8762a089c0 "00000000@test"
        mailbox = 0x7f8762a089a0 "00000000"
        context = 0x7f8762a089a9 "test"
        res = 0
        arg = {argc = 2, {argv = {0x7f8762a089c0 "00000000@test", 0x7f8762a089ce "email", 0x0}, {mailbox_context = 0x7f8762a089c0 "00000000@test", attribute = 0x7f8762a089ce "email", folder = 0x0}}}
        __PRETTY_FUNCTION__ = "acf_vm_info"
        __FUNCTION__ = "acf_vm_info"
#2  0x00007f876804eb3b in test_voicemail_vm_info (info=0x56485a20b7f0, cmd=TEST_EXECUTE, test=0x56485a20b7f0) at app_voicemail.c:15683
        vmu = 0x7f8734171c40
        chan = 0x7f8734166600
        testcontext = "test"
        testmailbox = "00000000"
        vminfo_cmd = "VM_INFO"
        vminfo_buf = '' <repeats 17 times>, "\222\240b\207\177[\272mXHV \223\240b\207\177P\222\240bd\276\347|\207\17\222\240b\207\177R-YXHVň\340e\377\201
                                                                                                                                                         (\222\240b\207\177", '' <repeats 18 times>, "6\223\240b\207\177\247/YXHV|\317{XHV\300\222\240\314\347|\207\177 \223\240b\207\177P\222\240b\207\177p\347|\207\177\360"...
        vminfo_args = "00000000@test,emailm\377\377\377\377", '' <repeats 20 times>, "\340\322yv\207\177", '' <repeats 22 times>, "\200", '' <repeats 15 times>, "de_D\265'Zh\377\177\377\377\377\377\377\377\377\377\265'Zh\377\177s\240lv\207\177\221\240b\207\177\207\177\202
                                                                               d\220\221\240b\207\177p\270mXHV"...
        res = 1
        test_ret = 0
        test_counter = 5
        test_items = {{vminfo_test_args = 0x7f876805614c "", vminfo_expected = 0x7f876805614c "", vminfo_ret = -1}, {vminfo_test_args = 0x7f876805cdea "00000000@test,badparam", vminfo_expected = 0x7f876805614c "", vminfo_ret = -1}, {vminfo_test_args = 0x7f876805ce01 "00000000@test", vminfo_expected = 0x7f876805614c "", vminfo_ret = -1}, {vminfo_test_args = 0x7f876805ce0f "00000000@test,exists", vminfo_expected = 0x7f8768057e89 "1", vminfo_ret = 0}, {vminfo_test_args = 0x7f876805ce24 "11111111@test,exists", vminfo_expected = 0x7f8768055a4b "0", vminfo_ret = 0}, {vminfo_test_args = 0x7f876805ce39 "00000000@test,email", vminfo_expected = 0x7f876805cd08 "[email protected]", vminfo_ret = 0}, {vminfo_test_args = 0x7f876805ce4d "11111111@test,email", vminfo_expected = 0x7f876805614c "", vminfo_ret = 0}, {vminfo_test_args = 0x7f876805ce61 "00000000@test,fullname", vminfo_expected = 0x7f876805cd3a "Test Framework Mailbox", vminfo_ret = 0}, {vminfo_test_args = 0x7f876805ce78 "00000000@test,pager", vminfo_expected = 0x7f876805cd58 "[email protected]", vminfo_ret = 0}, {vminfo_test_args = 0x7f876805ce8c "00000000@test,locale", vminfo_expected = 0x7f876805cd77 "en_US", vminfo_ret = 0}, {vminfo_test_args = 0x7f876805cea1 "00000000@test,tz", vminfo_expected = 0x7f876805a2d4 "central", vminfo_ret = 0}, {vminfo_test_args = 0x7f876805ceb2 "00000000@test,language", vminfo_expected = 0x7f876805c571 "en", vminfo_ret = 0}, {vminfo_test_args = 0x7f876805cec9 "00000000@test,password", vminfo_expected = 0x7f876805cd7d "9876", vminfo_ret = 0}}
        __PRETTY_FUNCTION__ = "test_voicemail_vm_info"
#3  0x00005648586c1a6c in test_execute (test=0x56485a20b7f0) at test.c:297
        begin = {tv_sec = 1709213893, tv_usec = 754182}
        result = (AST_TEST_PASS | AST_TEST_FAIL | unknown: 0x7f84)
#4  0x00005648586c301a in test_execute_multiple (name=0x0, category=0x7f8734173df6 "/apps/app_voicemail/", cli=0x7f8762a093e0) at test.c:688
        result_buf = '' <repeats 31 times>
        test = 0x56485a20b7f0
        mode = TEST_CATEGORY
        execute = 1
        res = 0
        __PRETTY_FUNCTION__ = "test_execute_multiple"
#5  0x00005648586c48b8 in test_cli_execute_registered (e=0x56485885a5a8 <test_cli+200>, cmd=-4, a=0x7f8762a093e0) at test.c:1156
        option1 = {0x5648587bd586 "all", 0x5648587bd57d "category", 0x0}
        option2 = {0x5648587bd58a "name", 0x0}
        __PRETTY_FUNCTION__ = "test_cli_execute_registered"
#6  0x000056485859d64c in ast_cli_command_full (uid=0, gid=0, fd=8, s=0x7f8762a096c0 "test execute category /apps/app_voicemail/") at cli.c:3025
        args = {0x56485885a5a8 <test_cli+200> "P$\332ZHV", 0x7f8734173de0 "test", 0x7f8734173de5 "execute", 0x7f8734173ded "category", 0x7f8734173df6 "/apps/app_voicemail/", 0x0, 0x7f8734000e9c "CTYPE", 0x0, 0x7f8762a095b8 "\377\377\377\377", 0x2bc30ff <error: Cannot access memory at address 0x2bc30ff>, 0x56485a18c5e0 "\360\322hw\207\177", 0x5e <error: Cannot access memory at address 0x5e>, 0x7f8700000000 <error: Cannot access memory at address 0x7f8700000000>, 0x7f8776e8e948 "7aNXHV", 0x7f877768d2f0 "", 0x776d44e8 <error: Cannot access memory at address 0x776d44e8>, 0x7f8762a095f0 "(G^v\207\177", 0x7f87776638c8 <_dl_lookup_symbol_x+296> "H\203\3040\205\300t\270I\213H\213|$PL\211\375H\213T$H\211\310H\205\377\204\237", 0xf <error: Cannot access memory at address 0xf>, 0x0, 0x5 <error: Cannot access memory at address 0x5>, 0x5648584d1e11 "strncmp", 0x7f877768d678 "\310\325hw\207\177", 0x7f8776e8e948 "7aNXHV", 0x7f877768d2f0 "", 0xaf0c3fcc <error: Cannot access memory at address 0xaf0c3fcc>, 0x7f8762a09640 "\210\203^v\207\177", 0x7f87776638c8 <_dl_lookup_symbol_x+296> "H\203\3040\205\300t\270I\213H\213|$PL\211\375H\213T$H\211\310H\205\377\204\237", 0xf <error: Cannot access memory at address 0xf>, 0x7f8776e8e948 "7aNXHV", 0x5 <error: Cannot access memory at address 0x5>, 0x0, 0x1 <error: Cannot access memory at address 0x1>, 0x7f877768d2f0 "", 0x7f8762a095b8 "\377\377\377\377", 0x7f8762a095c0 "\210\203^v\207\177", 0x7f877768d678 "\310\325hw\207\177", 0x0, 0x0, 0xffffffff <error: Cannot access memory at address 0xffffffff>, 0x7f87765e74d0 "\303S", 0x7f8700000001 <error: Cannot access memory at address 0x7f8700000001>, 0xeb <error: Cannot access memory at address 0xeb>, 0xffffffff <error: Cannot access memory at address 0xffffffff>, 0x7f87765e8388 "", 0x7f8776ef3f70 "", 0x7f876298e000 "", 0x7f8777669d3e <_dl_fixup+254> "I\211\305d\213%", 0x5 <error: Cannot access memory at address 0x5>, 0x0, 0x7f87765e4728 "Lw", 0x7f877768d2f0 "", 0x40 <error: Cannot access memory at address 0x40>, 0x564858838200 <strncmp@got[plt]> "Яgv\207\177", 0x0, 0x7f876bf04990 "\240L\360k\207\177", 0x7f876298e000 "", 0-\247", 0x7f87765e8388 "", 0x7f877667afd0 <__strncmp_sse2> "H\205\322\204+", 0x8 <error: Cannot access memory at address 0x8>, 0x7f8762a098c0 "", 0x7f8762a09d80 "P\236\240b\207\177"}
        e = 0x56485885a5a8 <test_cli+200>
        x = 4
        duplicate = 0x7f8734173de0 "test"
        tmp = "test execute category /apps/app_voicemail/v\207\177\364\224\240b\207\177J/fw\207\177\270"
        retval = 0x2 <error: Cannot access memory at address 0x2>
        a = {fd = 8, argc = 4, argv = 0x7f8762a09468, line = 0x0, word = 0x0, pos = 0, n = 0}
        __PRETTY_FUNCTION__ = "ast_cli_command_full"
#7  0x000056485859d801 in ast_cli_command_multiple_full (uid=0, gid=0, fd=8, size=43, s=0x7f8762a09b10 "test execute category /apps/app_voicemail/") at cli.c:3052
        cmd = "test execute category /apps/app_voicemail/", '' <repeats 140 times>, '\377' <repeats 42 times>...
        x = 42
        y = 43
        count = 0
#8  0x0000564858520cf2 in netconsole (vconsole=0x564858863a20 <consoles>) at asterisk.c:1464
        cmds_read = 1
        bytes_read = 43
        con = 0x564858863a20 <consoles>
        hostname = "debian", '' <repeats 57 times>
        inbuf = "test execute category /apps/app_voicemail/ute silent", '' <repeats 227 times>...
        outbuf = "\374Contact Polycom331/sip:[email protected]:5060 is now Reachable.  RTT: 17.468 msec
7m686 subscription_persistence_update: Updating persistence for 'PolycomSCA1->PolycomSCA1'  prune"...
        end_buf = 0x7f8762a09d10 "debian"
        start_read = 0x7f8762a09b10 "test execute category /apps/app_voicemail/"
        res = 2
        fds = {{fd = 8, events = 1, revents = 1}, {fd = 9, events = 1, revents = 1}}
        __FUNCTION__ = "netconsole"
#9  0x00005648586db236 in dummy_start (data=0x56485a084cb0) at utils.c:1607
        __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {140219452008128, -6456741738516871594, -224, 0, 140219608222096, 140219451498496, -6456741738558814634, -721844762805434794}, __mask_was_saved = 0}}, __pad = {0x7f8762a09e70, 0x0, 0x0, 0x0}}
        __cancel_routine = 0x56485851df40 <ast_unregister_thread>
        __cancel_arg = 0x7f8762a0a6c0
        __not_first_call = 0
        ret = 0x0
        a = {start_routine = 0x564858520a4c <netconsole>, data = 0x564858863a20 <consoles>, name = 0x7f8744000ba0 "netconsole", ' ' <repeats 11 times>, "started at [ 1569] asterisk.c listener()"}
        __PRETTY_FUNCTION__ = "dummy_start"
#10 0x00007f8776657044 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
        ret = <optimized out>
        pd = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140219452008128, 6443471119560443478, -224, 0, 140219608222096, 140219451498496, -6456741738518968746, -6456717025809955242}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimized out>
#11 0x00007f87766d761c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Asterisk Issue Guidelines

  • Yes, I have read the Asterisk Issue Guidelines

Metadata

Metadata

Assignees

Labels

Type

No type

Fields

No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions