[sr-dev] git:5.1:8ce74832: tm: safty checks when destroying the tm cell

Module: kamailio Branch: 5.1 Commit: 8ce748329be28b2a0f86f7711b03cdb696ee76d0 URL: https://github.com/kamailio/kamailio/commit/8ce748329be28b2a0f86f7711b03cdb… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2018-10-02T16:06:05+02:00 tm: safty checks when destroying the tm cell (cherry picked from commit afb7ef77faab405a4da0c7f601f35358a1130238) --- Modified: src/modules/tm/h_table.c --- Diff: https://github.com/kamailio/kamailio/commit/8ce748329be28b2a0f86f7711b03cdb… Patch: https://github.com/kamailio/kamailio/commit/8ce748329be28b2a0f86f7711b03cdb… --- diff --git a/src/modules/tm/h_table.c b/src/modules/tm/h_table.c index 4ca611e6ab..4b1f0233f7 100644 --- a/src/modules/tm/h_table.c +++ b/src/modules/tm/h_table.c @@ -132,6 +132,10 @@ void free_cell_helper( LM_DBG("freeing transaction %p from %s:%u\n", dead_cell, fname, fline); + if(dead_cell==NULL) { + return; + } + if(dead_cell->prev_c != NULL && dead_cell->next_c != NULL) { if(likely(silent == 0)) { LM_WARN("removed cell %p is still linked in hash table (%s:%u)\n", @@ -153,6 +157,10 @@ void free_cell_helper( if(dead_cell->fcount!=1) { LM_WARN("unexpected fcount value: %d\n", dead_cell->fcount); } + if(dead_cell->uac==NULL || dead_cell->uac!=T_UAC_PTR(dead_cell)) { + LM_WARN("unexpected tm cell content: %p\n", dead_cell); + return; + } if(unlikely(has_tran_tmcbs(dead_cell, TMCB_DESTROY))) run_trans_callbacks(TMCB_DESTROY, dead_cell, 0, 0, 0);