[sr-dev] [tracker] Task opened: Double Free -- Crash/Coredump and possible security vulnerability

[sip-router]

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.

A new Flyspray task has been opened.  Details are below. 

User who did this - Bayan Towfiq (btowfiq) 

Attached to Project - sip-router
Summary - Double Free -- Crash/Coredump and possible security vulnerability
Task Type - Bug Report
Category - dialog
Status - Assigned
Assigned To - Timo Reimann
Operating System - Linux
Severity - Critical
Priority - Normal
Reported Version - Development
Due in Version - Undecided
Due Date - Undecided
Details - version: kamailio 3.2.0 (x86_64/linux) 639f0a
flags: STATS: Off, USE_IPV6, USE_TCP, USE_TLS, TLS_HOOKS, USE_RAW_SOCKS, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MEM, SHM_MMAP, PKG_MALLOC, DBG_QM_MALLOC, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLACKLIST, HAVE_RESOLV_RES
ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535, DEFAULT PKG_SIZE 4MB
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
id: 639f0a 
compiled on 07:18:31 Oct 29 2011 with gcc 4.4.3


Dialog module crashed in kamailio 3.2.0 with the following log error (double free) and below backtrace.  This is a potential remote security vulnerability in addition to the crash which is why severity is set to Critical.  Please let me know if further information is needed to debug.


Nov  6 18:04:33 guru /usr/local/sbin/kamailio[8282]: CRITICAL: dialog [dlg_hash.c:597]: bogus ref -1 with cnt 1 for dlg 0x7f47dbd0eee8 [16086:1982422345] with clid '1124787051_76787956 at 4.55.17.35' and tags 'gK0a13fca4' '' Nov  6 18:04:33 guru /usr/local/sbin/kamailio[8282]: : <core> [mem/q_malloc.c:457]: BUG: qm_free: freeing already freed pointer, first free: dialog: dlg_hash.c: destroy_dlg(217) - aborting Nov  6 18:04:33 guru /usr/local/sbin/kamailio[8294]: : <core> [pass_fd.c:293]: ERROR: receive_fd: EOF on 18 Nov  6 18:04:33 guru /usr/local/sbin/kamailio[8272]: ALERT: <core> [main.c:751]: child process 8282 exited by a signal 6 Nov  6 18:04:33 guru /usr/local/sbin/kamailio[8272]: ALERT: <core> [main.c:754]: core was generated Nov  6 18:05:33 guru /usr/local/sbin/kamailio[8272]: : <core> [main.c:660]: BUG: shutdown timeout triggered, dying... Nov  6 18:05:34 guru init: kamailio main process (8272) killed by ABRT signal Nov  6 18:05:34 guru init: kamailio main process ended,
respawning Nov  6 18:05:34 guru kamailio: WARNING: <core> [daemonize.c:352]: pid file contains old pid, replacing pid





Full backtrace below:

(gdb) bt full
#0  0x00007f47f38b3a75 in raise () from /lib/libc.so.6
No symbol table info available.
#1  0x00007f47f38b75c0 in abort () from /lib/libc.so.6
No symbol table info available.
#2  0x0000000000534708 in qm_free (qm=0x7f47db9be000, p=0x7f47dbe5d3a8, file=0x7f47ec231bef "dialog: dlg_hash.c", func=0x7f47ec231f52 "destroy_dlg", line=217) at mem/q_malloc.c:458
        f = 0x7f47dbe5d378
        size = <value optimized out>
#3  0x00007f47ec218161 in destroy_dlg (dlg=0x7f47dbd0eee8) at dlg_hash.c:217
        ret = <value optimized out>
        __FUNCTION__ = "destroy_dlg"
#4  0x00007f47ec21a545 in unref_dlg (dlg=0x7f47dbd0eee8, cnt=0) at dlg_hash.c:597
        d_entry = 0x7f47dbcb1c80
#5  0x00007f47f193d5bd in free_cell (dead_cell=0x7f47dbe48920) at h_table.c:175
        b = <value optimized out>
        i = <value optimized out>
        rpl = <value optimized out>
        tt = <value optimized out>
        foo = <value optimized out>
        cbs = 0x7f47dbcc5970
        __FUNCTION__ = "free_cell"
#6  0x00007f47f195991b in wait_handler (ti=<value optimized out>, wait_tl=<value optimized out>, data=<value optimized out>) at timer.c:676
        p_cell = 0x7f47dbe48920
#7  0x000000000051f4fd in timer_list_expire () at timer.c:894
        tl = 0x7f47dbe489a0
        ret = <value optimized out>
#8  timer_handler () at timer.c:959
        saved_ticks = 444520143
        run_slow_timer = <value optimized out>
#9  timer_main () at timer.c:998
No locals.
#10 0x000000000046454f in main_loop () at main.c:1655
        i = 8
        pid = <value optimized out>
        si = 0x0
        si_desc = "udp receiver child=7 sock=70.167.153.130:5060\000\000\000\000\000@\020", '\000' <repeats 12 times>, "\016\b\000\000\000\000\000\000\000\200\271،*\306v&\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\300\v\215\000\000\000\000\000\"\000\000\000\000\000\000\000\000\000@\020", '\000' <repeats 11 times>
#11 0x0000000000465dd2 in main (argc=11, argv=0x7fff47fcb288) at main.c:2475
        cfg_stream = <value optimized out>
        c = <value optimized out>
        r = <value optimized out>
        tmp = 0x7fff47fcbe83 ""
        tmp_len = 0
        port = <value optimized out>
        proto = <value optimized out>
        ret = <value optimized out>
        seed = 1033789824
        rfd = <value optimized out>
        debug_save = 272629760
        debug_flag = 34
        dont_fork_cnt = 0
        n_lst = 0x10400000
        p = <value optimized out>
(gdb) 


More information can be found at the following URL:
http://sip-router.org/tracker/index.php?do=details&task_id=173

You are receiving this message because you have requested it from the Flyspray bugtracking system.  If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.