[sr-dev] [tracker] Comment added: Crash in TCP Read on Kamailio 4.0.1 (Attachment added)

[sip-router]

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.

The following task has a new comment added:

FS#364 - Crash in TCP Read on Kamailio 4.0.1
User who did this - Vitaliy Aleksandrov (Vitaliy)

----------
I have one setup which crashed two time during the last week. It crashed when tried to accept TLS connection, but bt looks similar to the one in this report.

Details:
- Kamailio works as a gateway between WSS and TCP transports.
- System version is 4.1.0-dev9 (x86_64/linux) 576dce-dirty.

Compressed core file is in the attachment.

Backtrace:
(gdb) bt
#0  qm_detach_free (frag=0x7ffb9f211040, qm=<optimized out>) at mem/q_malloc.c:269
#1  qm_malloc (qm=0x7ffb9e88e000, size=144) at mem/q_malloc.c:386
#2  0x00007ffba734cb02 in shm_malloc (size=136) at ../../mem/shm_mem.h:262
#3  ser_malloc (size=<optimized out>) at tls_init.c:285
#4  0x00007ffba88b15c4 in CRYPTO_malloc () from /usr/local/lib/libcrypto.so.1.0.0
#5  0x00007ffba70fd3dd in tls1_setup_key_block () from /usr/local/lib/libssl.so.1.0.0
#6  0x00007ffba70f4b64 in ssl3_do_change_cipher_spec () from /usr/local/lib/libssl.so.1.0.0
#7  0x00007ffba70f5771 in ssl3_read_bytes () from /usr/local/lib/libssl.so.1.0.0
#8  0x00007ffba70f6ac8 in ssl3_get_message () from /usr/local/lib/libssl.so.1.0.0
#9  0x00007ffba70e8d37 in ssl3_get_cert_verify () from /usr/local/lib/libssl.so.1.0.0
#10 0x00007ffba70ea4b0 in ssl3_accept () from /usr/local/lib/libssl.so.1.0.0
#11 0x00007ffba735ad4a in tls_accept (c=0x7ffb9f03cae0, error=0x7fffce0682d0) at tls_server.c:350
#12 0x00007ffba736039b in tls_read_f (c=0x7ffb9f03cae0, flags=<optimized out>) at tls_server.c:1033
#13 0x000000000055e8b3 in tcp_read_headers (c=0x7ffb9f03cae0, read_flags=<optimized out>) at tcp_read.c:428
#14 0x000000000055f37d in tcp_read_req (con=0x7ffb9f03cae0, bytes_read=0x7fffce088540, read_flags=0x7fffce088560) at tcp_read.c:1269
#15 0x0000000000560b3c in handle_io (fm=<optimized out>, events=<optimized out>, idx=-1) at tcp_read.c:1617
#16 0x0000000000563c74 in io_wait_loop_epoll (repeat=<optimized out>, h=<optimized out>, t=<optimized out>) at io_wait.h:1092
#17 tcp_receive_loop (unix_sock=<optimized out>) at tcp_read.c:1728
#18 0x000000000055ac5c in tcp_init_children () at tcp_main.c:4959
#19 0x0000000000485885 in main_loop () at main.c:1702
#20 0x000000000041cab0 in main (argc=<optimized out>, argv=<optimized out>) at main.c:2533


Frame0:
(gdb) p *((char*)frag + sizeof(struct qm_frag))
$7 = 77 'M'

(gdb) frame
#0  qm_detach_free (frag=0x7ffb9f211040, qm=<optimized out>) at mem/q_malloc.c:269
269             FRAG_END(next)->prev_free=prev;
(gdb) p frag->u.nxt_free
$8 = (struct qm_frag *) 0x0
----------

One or more files have been attached.

More information can be found at the following URL:
http://sip-router.org/tracker/index.php?do=details&task_id=364#comment1168

You are receiving this message because you have requested it from the Flyspray bugtracking system.  If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.