[sr-dev] git:master: Improved Free at cscf_get_service_route(), caused a reproducable crash

[Daniel-Constantin Mierla]

Don't forget to put the component name in the first line of the commit.

Also, maybe you have time to check the issue reported in:

- http://lists.sip-router.org/pipermail/sr-users/2013-December/080857.html
- http://lists.sip-router.org/pipermail/sr-users/2013-December/080864.html

In short, IMS lib is using a custom parser for PAI, it should use the 
core one to get rid of the reported issue.

Thanks,
Daniel

On 09/12/13 23:01, Carsten Bock wrote:
> Module: sip-router
> Branch: master
> Commit: caa9954d3c017ce741245d8f2b338158caf2270f
> URL:    http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=caa9954d3c017ce741245d8f2b338158caf2270f
>
> Author: Carsten Bock <carsten at ng-voice.com>
> Committer: Carsten Bock <carsten at ng-voice.com>
> Date:   Mon Dec  9 23:00:08 2013 +0100
>
> Improved Free at cscf_get_service_route(), caused a reproducable crash
>
> ---
>
>   lib/ims/ims_getters.c |    6 ++++--
>   1 files changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/lib/ims/ims_getters.c b/lib/ims/ims_getters.c
> index 05450f1..8fce196 100644
> --- a/lib/ims/ims_getters.c
> +++ b/lib/ims/ims_getters.c
> @@ -1361,14 +1361,16 @@ str* cscf_get_service_route(struct sip_msg *msg, int *size, int is_shm) {
>   		h = h->next;
>   	}
>   	if (is_shm) {
> -		while (h)
> +		h = msg->headers;
> +		while (h) {
>   			if (h->name.len == 13
>   					&& strncasecmp(h->name.s, "Service-Route", 13) == 0) {
>   				h->parsed = 0;
>   				r = (rr_t*) h->parsed;
>   				free_rr(&r);
>   			}
> -		h = h->next;
> +			h = h->next;
> +		}
>   	}
>   
>   	return x;
>
>
> _______________________________________________
> sr-dev mailing list
> sr-dev at lists.sip-router.org
> http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-dev

-- 
Daniel-Constantin Mierla - http://www.asipto.com
http://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda