Router crash when resetting invalid HTTP token

Sure way to crash router with a simpl script that contain a bug, with any IOS version. Maybe someone at Cisco wants to give it a look.

Code below. Example application can be started with "call application session start <anything> <service> name.

When callTimer is reached (because the application fails to stop timer), HTTP token Gtok has been cleaned up already and router crashes.

A variant is not to use a timer and do reset after cleanup. That produces only a "Potential memory corruption" print on termina monitor.

package require httpios 1.0

proc sessInd {} {

  global Gtok

  set Gtok [::httpios::geturl http://54.175.219.8/ip -command callBack]

  timer start call_timer0 4

}

proc callBack {token} {

  puts -nonewline callBack

  ::httpios::cleanup $token

}

proc callTimer {} {

  global Gtok

  ::httpios::reset $Gtok

}

set fsm(INIT,ev_session_indication) "sessInd same_state"

set fsm(INIT,ev_call_timer0)            "callTimer same_state"

fsm define fsm INIT

so if you use call_timer only you see router crash, if you use named_timer you wont see router crash?

Thanks,

Raghavendra

Replacing call_timer0 with named_timer does not crash the router but produces a message "Potential memory corruption" on terminal monitor.

Could you please share crashinfo file and also let us know which IOS version you are using.

Thanks,

Raghavendra

Could you please share crashinfo file and also let us know which IOS version you are using.

No crashinfo file is produced. As mentioned I've tried multiple IOS versions including later 15.4M, and it crashes them all.

If start timer called globally,It created spurious memory access issues and affects performance of the Voice GW.

Are you trying to kicked off script immediately after configuring it on the Voice GW and every time the timer expires it issues a HTTP request to a server ?

If start timer called globally,It created spurious memory access issues and affects performance of the Voice GW.

 

Are you trying to kicked off script immediately after configuring it on the Voice GW and every time the timer expires it issues a HTTP request to a server ?

No. As you can see in the example above, all commands are executed from within valid event procedures.

I have raised bug for this issue.

Thanks,

Raghavendra

I have raised bug for this issue.

Thanks. Would be possible to post the bug id here?

ok, here is the bug id  CSCuu19831 .

Thanks,

Raghavendra

ok, here is the bug id  CSCuu19831 .

Thank you very much Raghavendra.