[Serdev] core dump with lcr module

[Christopher Crawford]

I am seeing a core dump when using the lcr module, next_gw routine only in a failure_route.  It seems to be related to adding a new via header.  In the configuration, I have simplified it to have one group and two gateways.  The dump occurs on a t_on_failure callback, when next_gw is called to route to the second gateway.  Below is the back trace.  

I am using the latest code from CVS.

Chris

#0  qm_free (qm=0x80fa980, p=0x80ffaec) at mem/q_malloc.c:178
#1  0x40089c91 in free_via_clen_lump (list=0x400aced4) at fix_lumps.h:80
#2  0x40088786 in print_uac_request (t=0x402f5b48, i_req=0x400acc40, branch=1076853464, uri=0x402f7ad8, len=0xbffff44c,
    send_sock=0x402f7ad8, proto=1076853464) at t_fwd.c:109
#3  0x40088b7e in add_uac (t=0x402f5b48, request=0x400acc40, uri=0xbffff4e8, next_hop=0xbffff4e8, proxy=0x810b898, proto=1)
    at t_fwd.c:228
#4  0x4008938f in t_forward_nonack (t=0x402f5b48, p_msg=0x400acc40, proxy=0x0, proto=0) at t_fwd.c:453
#5  0x400907ef in w_t_relay (p_msg=0x400acc40, _foo=0x0, _bar=0x0) at tm.c:886
#6  0x0804f162 in do_action (a=0x810db98, msg=0x400acc40) at action.c:611
#7  0x0805092c in run_actions (a=0x810db98, msg=0x400acc40) at action.c:719
#8  0x40099637 in run_failure_handlers (t=0x402f5b48, rpl=0x402f7ad8, code=1076853464) at t_reply.c:635
#9  0x40098a42 in t_should_relay_response (Trans=0x402f5b48, new_code=408, branch=0, should_store=0xbffff7e8,
    should_relay=0xbffff7ec, cancel_bitmap=0x402f7ad8, reply=0x402f7ad8) at t_reply.c:778
#10 0x4009530c in relay_reply (t=0x402f5b48, p_msg=0xffffffff, branch=0, msg_status=408, cancel_bitmap=0xbffff858)
    at t_reply.c:1004
#11 0x4008bd13 in final_response_handler (fr_tl=0x0) at timer.c:251
#12 0x4008b63d in timer_routine (ticks=1709, attr=0x0) at timer.c:952
#13 0x080793e3 in timer_ticker () at timer.c:146
#14 0x0805bb51 in main_loop () at main.c:1097
#15 0x0805cb2c in main (argc=0, argv=0x401708d8) at main.c:1568