[OpenSER-Devel] a new SUBSCRIBE crash

[Juha Heinanen]

this morning i got the following SUBSCRIBE crash.  this is with
svnrevision: 1:2767MS, which should be after a fix to another SUBSCRIBE
crash:

Revision 2767 - Directory Listing
Modified Fri Sep 14 14:35:06 2007 UTC (3 days, 16 hours ago) by anca_vamanu

- fixed a bug that generated running free on the same pointer twice(reported by Juha Heinanen <jh at tutpro.com>)

-- juha

(gdb) where
#0  0xb7eef410 in ?? ()
#1  0xbfb648dc in ?? ()
#2  0x00000006 in ?? ()
#3  0x00003cbc in ?? ()
#4  0xb7c21811 in raise () from /lib/tls/i686/cmov/libc.so.6
#5  0xb7c22fb9 in abort () from /lib/tls/i686/cmov/libc.so.6
#6  0x080bdfb0 in qm_free (qm=0x8156b60, p=0x820a76c,
    file=0xb76f369c "subscribe.c", func=0xb76f5703 "handle_subscribe",
    line=705) at mem/q_malloc.c:445
#7  0xb76ed2f8 in handle_subscribe (msg=0x820a204, str1=0x0, str2=0x0)
    at subscribe.c:705
#8  0x08053028 in do_action (a=0x8198e54, msg=0x820a204) at action.c:815
#9  0x0805522a in run_action_list (a=0x8198e54, msg=0x820a204) at action.c:132
#10 0x08093b07 in eval_expr (e=0x8198ed0, msg=0x820a204, val=0x0)
    at route.c:1099
#11 0x0809373d in eval_expr (e=0x8198f20, msg=0x820a204, val=0x0)
    at route.c:1415
#12 0x080936dc in eval_expr (e=0x8198f70, msg=0x820a204, val=0x0)
    at route.c:1420
#13 0x080531c4 in do_action (a=0x81994d8, msg=0x820a204) at action.c:671
#14 0x0805522a in run_action_list (a=0x8198a9c, msg=0x820a204) at action.c:132
#15 0x0805495f in do_action (a=0x81996fc, msg=0x820a204) at action.c:688
#16 0x0805522a in run_action_list (a=0x81996fc, msg=0x820a204) at action.c:132
#17 0x0805495f in do_action (a=0x819ae80, msg=0x820a204) at action.c:688
---Type <return> to continue, or q <return> to quit---
#18 0x0805522a in run_action_list (a=0x819602c, msg=0x820a204) at action.c:132
#19 0x0805495f in do_action (a=0x819f270, msg=0x820a204) at action.c:688
#20 0x0805522a in run_action_list (a=0x8193c54, msg=0x820a204) at action.c:132
#21 0x080555b8 in run_top_route (a=0x8193c54, msg=0x820a204) at action.c:112
#22 0x080885a2 in receive_msg (
    buf=0x81460e0 "SUBSCRIBE sip:x.x.x.x:5060;transport=udp SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.1.138:1444;branch=z9hG4bK-d87543-670ab7537272be40-1--d87543-;rport\r\nMax-Forwards: 69\r\nContact: <sip:x at 192.168.1.138"...,
    len=780, rcv_info=0xbfb65e54) at receive.c:156
#23 0x080b9527 in udp_rcv_loop () at udp_server.c:451
#24 0x08068c67 in main (argc=15, argv=0xbfb65fe4) at main.c:788

Sep 18 09:46:14 tutpro /usr/sbin/openser[15548]: BUG: qm_free: freeing already \
freed pointer, first free: subscribe.c: get_stored_info(1050) - aborting
Sep 18 09:46:14 tutpro /usr/sbin/openser[15575]: ERROR: receive_fd: EOF on 7
Sep 18 09:46:14 tutpro /usr/sbin/openser[15547]: core:handle_sigs: child proces\
s 15548 exited by a signal 6
Sep 18 09:46:14 tutpro /usr/sbin/openser[15547]: core:handle_sigs: core was gen\
erated
Sep 18 09:46:14 tutpro /usr/sbin/openser[15547]: core:handle_sigs: terminating \
due to SIGCHLD
Sep 18 09:46:14 tutpro /usr/sbin/openser[15575]: core:sig_usr: signal 15 receiv\
ed
...
Sep 18 09:46:14 tutpro /usr/sbin/openser[15554]: Memory status (pkg):
Sep 18 09:46:14 tutpro /usr/sbin/openser[15549]: qm_status (0x8156b60):
Sep 18 09:46:14 tutpro /usr/sbin/openser[15549]:  heap size= 4194304
Sep 18 09:46:14 tutpro /usr/sbin/openser[15549]:  used= 326464, used+overhead=7\
38756, free=3455548
Sep 18 09:46:14 tutpro /usr/sbin/openser[15549]:  max used (+overhead)= 745340