[sr-dev] [ openser-Bugs-2818273 ] crash when Content-length too big

[SourceForge.net]

Bugs item #2818273, was opened at 2009-07-08 01:28
Message generated for change (Comment added) made by marcushunger
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=743020&aid=2818273&group_id=139143

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: ver 1.5.x
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: crash when Content-length too big

Initial Comment:
Recently we encountered some crashes of kamailio 1.5.0 caused by messages with too big value of Content-length (more than 30000). When the parser in nathelper.c looks for old and new port it sometimes finds occurences after the real end of the message. Then the sanity check in del_lump() in data_lump.c finds that either offset or offset+len is greater than msg->len and calls abort().

----------------------------------------------------------------------

Comment By: Marcus Hunger (marcushunger)
Date: 2010-03-01 12:45

Message:
I am afraid, this issue is not yet fixed. The latest release version
(1.5.4-notls (i386/linux)) still produces: 
Mar  1 11:53:12 test02 /usr/sbin/kamailio[5173]: ERROR:core:anchor_lump:
offset exceeds message size (1799 > 1783)...
Mar  1 11:53:12 test02 /usr/sbin/kamailio[5173]:
ERROR:nathelper:force_rtp_proxy: anchor_lump failed

This is reproducible. I even experienced a crash:
Feb 26 14:58:44 test02 /usr/sbin/kamailio[21020]: CRITICAL:core:del_lump:
offset exceeds message size (1186 > 1132) aborting...

To trigger this, one needs to send an invite with a content-length bigger
than the actual content through force_rtp_proxy.

----------------------------------------------------------------------

Comment By: Daniel-Constantin Mierla (miconda)
Date: 2009-10-05 08:54

Message:
This should be fixed in 1.5.2 and latest svn, have you tried the latest 1.5
svn branch?

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2009-07-08 17:17

Message:
'kamailio -V' says 'kamailio 1.5.0-notls (x86_64/linux)'

----------------------------------------------------------------------

Comment By: Klaus Darilion (klaus_darilion)
Date: 2009-07-08 10:38

Message:
Which excat version are you using? There were some bugfixes recently.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=743020&aid=2818273&group_id=139143