1.4.10 Parking crashes Asterisk :-(

100% repeatable (for me).

Sip phone A calls Sip phone B.

Either Sip phone A or B does #700. The party that keyed #700 gets the parked announcement (eg 701) and the other party get MOH. Curiously there is still an audio channel between the two SIP phones at this point.

When the party that typed #700 hangs up, Asterisk crashes.

This has been working in previous 1.4’s (but not 1.4.10) and I havn’t changed my parking config.

Here’s what comes up on the console as it crashes.

– <SIP/Testsnom-00709570> Playing ‘digits/7’ (language ‘en’)
– <SIP/Testsnom-00709570> Playing ‘digits/0’ (language ‘en’)
– <SIP/Testsnom-00709570> Playing ‘digits/1’ (language ‘en’)
– Added extension ‘701’ priority 1 to parkedcalls
– Stopped music on hold on SIP/115-0072f7a0
== SIP/115-0072f7a0 got tired of being parked
== Spawn extension (macro-stdsip, s, 6) exited non-zero on ‘SIP/Testsnom-00709570’ in macro ‘stdsip’
== Spawn extension (macro-stdsip, s, 6) exited non-zero on ‘SIP/Testsnom-00709570’
*** glibc detected *** asterisk: double free or corruption (out): 0x00002ab23a7ed9f0 ***
======= Backtrace: =========
/lib/libc.so.6[0x2ab23a620733]
/lib/libc.so.6(__libc_free+0x84)[0x2ab23a6208b4]
asterisk(ast_channel_free+0xf6)[0x438fa6]
asterisk(ast_hangup+0x35a)[0x43b84a]
/usr/lib/asterisk/modules/res_features.so[0x2aaaab8298c0]
asterisk[0x4a719c]
/lib/libpthread.so.0[0x2ab239da23ca]
/lib/libc.so.6(__clone+0x6d)[0x2ab23a67f55d]
======= Memory map: ========