November 2011 - sr-dev - kamailio.org

git:master: parser: don't free on error To param linked in to_body struct
by Daniel-Constantin Mierla 24 Nov '11

24 Nov '11

Module: sip-router Branch: master Commit: 6299704ebb280214f35fc86968d86be972219e51 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=6299704… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: Thu Nov 24 17:22:26 2011 +0100 parser: don't free on error To param linked in to_body struct - if a To header parameter was already linked in to_body struct, don't free if there is a parsing error for it later, it will be freed by free_to_params() - reported by Bayan Towfiq in FS#180 --- parser/parse_to.c | 36 +++++++++++++++++------------------- 1 files changed, 17 insertions(+), 19 deletions(-) diff --git a/parser/parse_to.c b/parser/parse_to.c index bcd0bd0..cb2ea75 100644 --- a/parser/parse_to.c +++ b/parser/parse_to.c @@ -53,7 +53,7 @@ enum { -#define add_param( _param , _body ) \ +#define add_param( _param , _body , _newparam ) \ do{\ DBG("DEBUG: add_param: %.*s=%.*s\n",param->name.len,ZSW(param->name.s),\ param->value.len,ZSW(param->value.s));\ @@ -62,6 +62,7 @@ enum { (_body)->last_param =(_param);\ if ((_param)->type==TAG_PARAM)\ memcpy(&((_body)->tag_value),&((_param)->value),sizeof(str));\ + _newparam = 0;\ }while(0); @@ -73,11 +74,13 @@ static /*inline*/ char* parse_to_param(char *buffer, char *end, int *returned_status) { struct to_param *param; + struct to_param *newparam; int status; int saved_status; char *tmp; param=0; + newparam=0; status=E_PARA_VALUE; saved_status=E_PARA_VALUE; for( tmp=buffer; tmp<end; tmp++) @@ -99,7 +102,7 @@ static /*inline*/ char* parse_to_param(char *buffer, char *end, case PARA_VALUE_TOKEN: param->value.len = tmp-param->value.s; status = E_PARA_VALUE; - add_param( param , to_b ); + add_param(param, to_b, newparam); break; case F_CRLF: case F_LF: @@ -132,7 +135,7 @@ static /*inline*/ char* parse_to_param(char *buffer, char *end, param->value.len = tmp-param->value.s; saved_status = E_PARA_VALUE; status = F_LF; - add_param( param , to_b ); + add_param(param, to_b, newparam); break; case F_CR: status=F_CRLF; @@ -171,7 +174,7 @@ static /*inline*/ char* parse_to_param(char *buffer, char *end, param->value.len = tmp-param->value.s; saved_status = E_PARA_VALUE; status = F_CR; - add_param( param , to_b ); + add_param(param, to_b, newparam); break; case F_CRLF: case F_CR: @@ -202,7 +205,7 @@ static /*inline*/ char* parse_to_param(char *buffer, char *end, case PARA_VALUE_TOKEN: status = E_PARA_VALUE; param->value.len = tmp-param->value.s; - add_param( param , to_b ); + add_param(param , to_b, newparam); case E_PARA_VALUE: saved_status = status; goto endofheader; @@ -242,7 +245,7 @@ static /*inline*/ char* parse_to_param(char *buffer, char *end, break; case PARA_VALUE_QUOTED: param->value.len=tmp-param->value.s; - add_param( param , to_b ); + add_param(param, to_b, newparam); status = E_PARA_VALUE; break; case F_CRLF: @@ -277,7 +280,7 @@ static /*inline*/ char* parse_to_param(char *buffer, char *end, case PARA_VALUE_TOKEN: param->value.len=tmp-param->value.s; semicolon_add_param: - add_param(param,to_b); + add_param(param, to_b, newparam); case E_PARA_VALUE: param = (struct to_param*) pkg_malloc(sizeof(struct to_param)); @@ -289,6 +292,8 @@ semicolon_add_param: memset(param,0,sizeof(struct to_param)); param->type=GENERAL_PARAM; status = S_PARA_NAME; + /* link to free mem if not added in to_body list */ + newparam = param; break; case F_CRLF: case F_LF: @@ -483,19 +488,19 @@ endofheader: /* parameter without '=', e.g. foo */ param->value.s=0; param->value.len=0; - add_param(param, to_b); + add_param(param, to_b, newparam); saved_status=E_PARA_VALUE; break; case S_PARA_VALUE: /* parameter with null value, e.g. foo= */ param->value.s=tmp; param->value.len=0; - add_param(param, to_b); + add_param(param, to_b, newparam); saved_status=E_PARA_VALUE; break; case PARA_VALUE_TOKEN: param->value.len=tmp-param->value.s; - add_param(param, to_b); + add_param(param, to_b, newparam); saved_status=E_PARA_VALUE; break; case E_PARA_VALUE: @@ -510,7 +515,7 @@ endofheader: return tmp; error: - if (param) pkg_free(param); + if (newparam) pkg_free(newparam); to_b->error=PARSE_ERROR; *returned_status = status; return tmp; @@ -527,15 +532,8 @@ char* parse_to(char* buffer, char *end, struct to_body *to_b) saved_status=START_TO; /* fixes gcc 4.x warning */ status=START_TO; + memset(to_b, 0, sizeof(struct to_body)); to_b->error=PARSE_OK; - to_b->uri.len = 0; - to_b->uri.s= 0; - to_b->display.len = 0; - to_b->display.s = 0; - to_b->tag_value.len = 0; - to_b->tag_value.s = 0; - to_b->param_lst = 0; - to_b->last_param = 0; foo=0; for( tmp=buffer; tmp<end; tmp++)

1 0

[tracker] Comment added: DOUBLE FREE / CRASH in parse_to.c
by sip-router 24 Nov '11

24 Nov '11

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY. The following task has a new comment added: FS#180 - DOUBLE FREE / CRASH in parse_to.c User who did this - Bayan Towfiq (btowfiq) ---------- 3.2 ---------- More information can be found at the following URL: http://sip-router.org/tracker/index.php?do=details&task_id=180#comment394 You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.

1 0

[tracker] Comment added: Kamailio / Crash / Textops (302 Redirect)
by sip-router 24 Nov '11

24 Nov '11

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY. The following task has a new comment added: FS#181 - Kamailio / Crash / Textops (302 Redirect) User who did this - Brandon Armstead (CRYY2010) ---------- Running this patch now - will let you know very shortly how it works out. This crash is pretty much reproducible within a 5-10 minute span. ---------- More information can be found at the following URL: http://sip-router.org/tracker/index.php?do=details&task_id=181#comment393 You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.

1 0

[tracker] Comment added: DOUBLE FREE / CRASH in parse_to.c
by sip-router 24 Nov '11

24 Nov '11

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY. The following task has a new comment added: FS#180 - DOUBLE FREE / CRASH in parse_to.c User who did this - Daniel-Constantin Mierla (miconda) ---------- What is the version of kamailio? ---------- More information can be found at the following URL: http://sip-router.org/tracker/index.php?do=details&task_id=180#comment392 You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.

1 0

[tracker] Comment added: PV $ds in xlog in branch_route
by sip-router 24 Nov '11

24 Nov '11

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY. The following task has a new comment added: FS#182 - PV $ds in xlog in branch_route User who did this - Pawel Sternal (Sternik) ---------- Thanks. This patch fixes the problem. Regards. ---------- More information can be found at the following URL: http://sip-router.org/tracker/index.php?do=details&task_id=182#comment391 You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.

1 0

[tracker] Comment added: Kamailio / Crash / Textops (302 Redirect) (Attachment added)
by sip-router 24 Nov '11

24 Nov '11

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY. The following task has a new comment added: FS#181 - Kamailio / Crash / Textops (302 Redirect) User who did this - Daniel-Constantin Mierla (miconda) ---------- Can you try the attached patch (it is for 3.1 branch)? I'm uploading it for convenience, it includes the three commits I just did in master branch, touching core, tm and textops. The issue is related to set_body(), which was not really safe to use in failure_route if there were other changes to body done in request_route. Let me know if works ok now, then I will backport. ---------- One or more files have been attached. More information can be found at the following URL: http://sip-router.org/tracker/index.php?do=details&task_id=181#comment390 You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.

1 0

git:master: core: better check for cloned lumps in shared memory
by Daniel-Constantin Mierla 24 Nov '11

24 Nov '11

Module: sip-router Branch: master Commit: 8652f5f5fb2b10210c65b04772064c452608c728 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=8652f5f… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: Thu Nov 24 15:26:47 2011 +0100 core: better check for cloned lumps in shared memory - bitwise test for LUMPFLAG_SHMEM --- data_lump.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/data_lump.c b/data_lump.c index 433ce2f..5016383 100644 --- a/data_lump.c +++ b/data_lump.c @@ -650,7 +650,7 @@ void del_nonshm_lump( struct lump** lump_list ) crt = *lump_list; while (crt) { - if (crt->flags!=LUMPFLAG_SHMEM) { + if (!(crt->flags&LUMPFLAG_SHMEM)) { /* unlink it */ foo = crt; crt = crt->next; @@ -665,7 +665,7 @@ void del_nonshm_lump( struct lump** lump_list ) prev_r = crt; while(r){ foo=r; r=r->after; - if (foo->flags!=LUMPFLAG_SHMEM) { + if (!(foo->flags&LUMPFLAG_SHMEM)) { prev_r->after = r; free_lump(foo); pkg_free(foo); @@ -678,7 +678,7 @@ void del_nonshm_lump( struct lump** lump_list ) prev_r = crt; while(r){ foo=r; r=r->before; - if (foo->flags!=LUMPFLAG_SHMEM) { + if (!(foo->flags&LUMPFLAG_SHMEM)) { prev_r->before = r; free_lump(foo); pkg_free(foo);

1 0

git:master: textops(k): free only pkg body lumps for set_body()
by Daniel-Constantin Mierla 24 Nov '11

24 Nov '11

Module: sip-router Branch: master Commit: c22a3ec7366ad1a3cc0b5e8229fbabe2c179cca1 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=c22a3ec… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: Thu Nov 24 15:30:15 2011 +0100 textops(k): free only pkg body lumps for set_body() - if set_body() is used in failure_route, it should not destroy completely the lumps cloned in tm, just ignore them and free the ones added in failure_route before execution of itself - reported by Brandon Armstead, FS#181 --- modules_k/textops/textops.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/modules_k/textops/textops.c b/modules_k/textops/textops.c index 4fabd22..755b4be 100644 --- a/modules_k/textops/textops.c +++ b/modules_k/textops/textops.c @@ -1259,7 +1259,7 @@ static int set_body_f(struct sip_msg* msg, char* p1, char* p2) return -1; } - free_lump_list(msg->body_lumps); + del_nonshm_lump( &(msg->body_lumps) ); msg->body_lumps = NULL; if (msg->content_length)

1 0

git:master: tm: backup/restore lump lists for faked requests
by Daniel-Constantin Mierla 24 Nov '11

24 Nov '11

Module: sip-router Branch: master Commit: b6d90904de590a3f6a95bca8f89cf2521d630902 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=b6d9090… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: Thu Nov 24 15:28:04 2011 +0100 tm: backup/restore lump lists for faked requests - some cfg functions that can be used in failure_route can destroy the head of lump lists, thus better backup before and restore after failure_route execution --- modules/tm/t_reply.c | 13 +++++++++++++ 1 files changed, 13 insertions(+), 0 deletions(-) diff --git a/modules/tm/t_reply.c b/modules/tm/t_reply.c index b7c3a84..90ffa73 100644 --- a/modules/tm/t_reply.c +++ b/modules/tm/t_reply.c @@ -764,6 +764,11 @@ void faked_env( struct cell *t, struct sip_msg *msg) #endif static struct socket_info* backup_si; + static struct lump *backup_add_rm; + static struct lump *backup_body_lumps; + static struct lump_rpl *backup_reply_lump; + + if (msg) { /* remember we are back in request processing, but process * a shmem-ed replica of the request; advertise it in route type; @@ -803,6 +808,10 @@ void faked_env( struct cell *t, struct sip_msg *msg) /* set default send address to the saved value */ backup_si=bind_address; bind_address=t->uac[0].request.dst.send_sock; + /* backup lump lists */ + backup_add_rm = t->uas.request->add_rm; + backup_body_lumps = t->uas.request->body_lumps; + backup_reply_lump = t->uas.request->reply_lump; } else { /* restore original environment */ set_t(backup_t, backup_branch); @@ -819,6 +828,10 @@ void faked_env( struct cell *t, struct sip_msg *msg) xavp_set_list(backup_xavps); #endif bind_address=backup_si; + /* restore lump lists */ + t->uas.request->add_rm = backup_add_rm; + t->uas.request->body_lumps = backup_body_lumps; + t->uas.request->reply_lump = backup_reply_lump; } }

1 0

[tracker] Comment added: PV $ds in xlog in branch_route
by sip-router 24 Nov '11

24 Nov '11

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY. The following task has a new comment added: FS#182 - PV $ds in xlog in branch_route User who did this - Daniel-Constantin Mierla (miconda) ---------- I committed a patch to be safe to use $ds in branch_route (backup/restore the branch iterator). Here is the link to the commit: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=c5f101d… If you can test it and all goes ok, I will backport to 3.2/3.1. Thanks. ---------- More information can be found at the following URL: http://sip-router.org/tracker/index.php?do=details&task_id=182#comment389 You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.

1 0