Hi: I want to insert a header field without the script. Instead I insert it in the tm module's t_relay() function. Next is my code. The first time I use the pkg_malloc(), but ser report that: BUG: qm_*: prev. fragm. tail overwritten(c0c0c000, abcdefed) so I changed the pkg_malloc to the shm_malloc(); this time the error happend again in the different place. typedef int(*local_fp)(struct sip_msg *msg, str *txt, int flags); str *str1; char *tmp = "P-Security-Nobody: this is a test header for \r\n"; local_fp append_to_reply = NULL; str1 = (str*)shm_malloc(sizeof(str)); if(str1) { str1->len = strlen(tmp); str1->s = (char*)shm_malloc(str1->len); strcpy(str1->s, tmp); append_to_reply = (local_fp)find_export("append_hf", 1, 0); if(append_to_reply){ DBG("DEBUG: SUNZJ find apppend_to_reply\n"); append_to_reply(p_msg, str1, NULL); } } the next is gdb's output. Program received signal SIGABRT, Aborted. [Switching to Thread -1208486208 (LWP 6439)] 0x00ad77a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2 (gdb) (gdb) where #0 0x00ad77a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2 #1 0x00b1b955 in raise () from /lib/tls/libc.so.6 #2 0x00b1d319 in abort () from /lib/tls/libc.so.6 #3 0x0808cb9d in qm_debug_frag (qm=0xb5f7e000, f=0x6) at mem/q_malloc.c:156 #4 0x0808d1ab in qm_malloc (qm=0xb5f7e000, size=4107, file=0x13fb49 "h_table.c", func=0x13fb1e "build_cell", line=231) at mem/q_malloc.c:379 #5 0x0011b654 in build_cell (p_msg=0x814bec0) at shm_mem.h:135 #6 0x0012c23e in t_newtran (p_msg=0x814bec0) at t_lookup.c:988 #7 0x00123f4e in t_relay_to (p_msg=0x814bec0, proxy=0x0, proto=0, replicate=0) at t_funcs.c:241 #8 0x0012f450 in w_t_relay (p_msg=0x814bec0, _foo=0x0, _bar=0x0) at tm.c:893 #9 0x0804fe41 in do_action (a=0x814a4ac, msg=0x814bec0) at action.c:611 #10 0x08050bad in run_actions (a=0x814a4ac, msg=0x814bec0) at action.c:719 #11 0x08074fe8 in eval_elem (e=0x814a4fc, msg=0x814bec0) at route.c:605 #12 0x08075482 in eval_expr (e=0x814a4fc, msg=0x814bec0) at route.c:654 #13 0x080754be in eval_expr (e=0x814a540, msg=0x814bec0) at route.c:670 #14 0x0804edd5 in do_action (a=0x814a684, msg=0x814bec0) at action.c:587 #15 0x08050bad in run_actions (a=0x814a684, msg=0x814bec0) at action.c:719 #16 0x0805019f in do_action (a=0x814a3ac, msg=0x814bec0) at action.c:376 #17 0x08050bad in run_actions (a=0x814a3ac, msg=0x814bec0) at action.c:719 #18 0x0806de90 in receive_msg ( buf=0x80db480 "INVITE sip:862222@sip.suntest.com SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.0.19:5500;branch=z9hG4bK958088909\r\nFrom: <sip:861111@sip.suntest.com>;tag=1137899792;tag=1613933050\r\nTo: <sip:862222@sip.suntest.com"..., len=1018, rcv_info=0xbffe1590) at receive.c:162 #19 0x080858dc in udp_rcv_loop () at udp_server.c:458 #20 0x0805d77f in main_loop () at main.c:1032 #21 0x0805ece5 in main (argc=2, argv=0xbffe1754) at main.c:1569 Anyone who tell me what the problem is will be appreciated. Thanks for your kind help Best Regards. Sun Zongjun