Kamailio 1.5.4 crashes with the following backtrace.
(gdb) bt #0 free_to_params (tb=0x79ffc0) at parser/parse_to.c:79 #1 free_to (tb=0x79ffc0) at parser/parse_to.c:88 #2 0x000000000047fe82 in clean_hdr_field (hf=0x2b32776ec6a0) at parser/hf.c:187 #3 0x00002b327492f525 in clean_msg_clone (type=<value optimized out>, trans=<value optimized out>, req=0x2b32776eb510, rpl=0x79f220, code=<value optimized out>) at sip_msg.h:54 #4 run_trans_callbacks (type=<value optimized out>, trans=<value optimized out>, req=0x2b32776eb510, rpl=0x79f220, code=<value optimized out>) at t_hooks.c:245 #5 0x00002b3274949a1d in relay_reply (t=0x2b32776ed130, p_msg=0x79f220, branch=<value optimized out>, msg_status=200, cancel_bitmap=0x7fff5438ecf8) at t_reply.c:1163 #6 0x00002b327494a123 in reply_received (p_msg=0x79f220) at t_reply.c:1511 #7 0x000000000041f08b in forward_reply (msg=0x79f220) at forward.c:576 #8 0x0000000000445453 in receive_msg ( buf=0x719200 "SIP/2.0 200 OK\r\nVia: SIP/2.0/UDP xxx.xxx.xxx.114;branch=z9hG4bKb415.46c549d2.0\r\nVia: SIP/2.0/UDP xx.xxx.xx.xxx:5060;received=xxx.xxx.xx.xxx;branch=z9hG4bK6cd2ebfb;rport=5060\r\nRecord-Route: <sip:xxx.xxx.xxx.x"..., len=1106, rcv_info=0x7fff5438ede0) at receive.c:212 #9 0x00000000004795ee in udp_rcv_loop () at udp_server.c:449 #10 0x000000000042774e in main_loop (argc=3, argv=0x7fff5438eff8) at main.c:774 #11 main (argc=3, argv=0x7fff5438eff8) at main.c:1321
This is occuring on a centos box, 2.6.18-164.11.1.el5 #1 SMP Wed Jan 20 07:32:21 EST 2010 x86_64 x86_64 x86_64 GNU/Linux
The really strange thing is the source of the problem appears to be in clean_hdr_field (hf=0x2b32776ec6a0) at parser/hf.c:187
void clean_hdr_field(struct hdr_field* hf) { if (hf->parsed){ switch(hf->type){
...
case HDR_RPID_T: free_to(hf->parsed); break;
...
output from gdb shows hf->parsed to be NULL, however the call to free_to(hf->parsed) is being called, from there bad things happen.
Thanks in advance.
Gene