We were experiencing the issue with 1.5.4 released version, we upgraded from svn and the issue still persists.  I have a backtrace from both versions.

 

I agree it is a free of a null pointer, but the if(hf->parsed) should be the test for NULL, and only execute code if not NULL.  However this test is failing. 

 

 

----- Original Message -----
From: "Henning Westerholt" <henning.westerholt@1und1.de>
To: sr-users@lists.sip-router.org
Cc: "Alex Balashov" <abalashov@evaristesys.com>, gwillingham@comcast.net
Sent: Monday, August 30, 2010 11:45:11 AM
Subject: Re: [SR-Users] Kamailio 1.5.4 crash

On Monday 30 August 2010, Alex Balashov wrote:
> On 08/30/2010 11:33 AM, gwillingham@comcast.net wrote:
> > output from gdb shows hf->parsed to be NULL, however the call to
> > free_to(hf->parsed) is being called, from there bad things happen.
>
> Sounds like a double free(), or a free() of something that was never
> allocated.

Hello Gene,

1.5.4 was released in February, i think - do you use the version from tar.gz?
I've checked the file in question, there were one fix in the last month:

r6036 | miconda | 2010-07-30 20:18:33 +0200 (Fr, 30 Jul 2010) | 4 lines
- fix off-by-one bug for quoted parameter values in parse_to
- patch by Alex Hermann, SF#3035382

which maybe could help you here. I'd suggest that you extract the SIP message
in question from the backtrace (receive_msg, buf) and then try to reproduce
the crash. If it crash again, just update to the latest 1.5 branch state, and
see if it crashes again. It contains some more fixes, one or two also could
cause crashes in some special conditions.

Cheers,

Henning