[sr-dev] Crash if t_release() is executed after t_relay_to(), when this last returns -1

Iñaki Baz Castillo ibc at aliax.net
Mon Nov 28 21:15:06 CET 2011


2011/11/28 José Luis Millán <jmillan at aliax.net>:
> Hi,
>
> Kamailio 3.2 is crashing if t_release() is executed after
> t_relay_to() returns -1
>
>
> ---
>
> if ! t_relay_to() {
>  t_release();
> }
>
> ---
>
> Error -1 is generated in t_relay_to, in this case, when trying to
> reach a domainname which hasn't got a DNS record.
>
>
> Here the log of the execution of t_relay_to:
>
> ERROR: <core> [resolve.c:1540]: ERROR: sip_hostport2su: could not
> resolve hostname: "proxy1.jssip.net"
> ERROR: tm [ut.h:318]: failed to resolve "proxy1.jssip.net"
> ERROR: tm [t_fwd.c:1528]: ERROR: t_forward_nonack: failure to add branches
> ERROR: tm [tm.c:1369]: ERROR: w_t_relay_to: t_relay_to failed
> WARNING: script | uovyxruroybhnsy | call | t_relay(): -1 generic internal error
>
> This is the log for the execution of t_release():
>
> <core> [mem/q_malloc.c:457]: BUG: qm_free: freeing already freed
> pointer, first free: tm: h_table.c: free_cell(157) - aborting
> ALERT: <core> [main.c:745]: child process 24217 exited by a signal 6
> ALERT: <core> [main.c:748]: core was not generated
> INFO: <core> [main.c:760]: INFO: terminating due to SIGCHLD
> INFO: <core> [main.c:811]: INFO: signal 15 received


This bug is affecting us in a production system. A workaround is not
to call t_release() if t_relay() returns a negative value, but it
shouldn't crash otherwise.

Regards.


-- 
Iñaki Baz Castillo
<ibc at aliax.net>



More information about the sr-dev mailing list