[sr-dev] [kamailio/kamailio] crash after t_resume() when calling msg_apply_changes() (#676)

[Victor Seva]

```
Jun 17 14:40:25 sp1 (local7.crit) proxy[16946]: : <core> [mem/q_malloc.c:439]: qm_free(): BUG: qm_free: bad pointer 0x7efb557e3680 (out of memory block!) called from <core>: parser/hf.c: free_hdr_field_lst(213) - aborting
Jun 17 14:40:30 sp1 (local7.crit) proxy[16951]: CRITICAL: <core> [pass_fd.c:275]: receive_fd(): EOF on 39
```
```
#0  0x00007efc5e752067 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x00007efc5e753448 in abort () from /lib/x86_64-linux-gnu/libc.so.6
#2  0x00000000005ec6e7 in qm_free (qm=0x7efc5c71c010, p=0x0, file=0x6f2c25 "<core>: parser/hf.c", func=0x0, line=10007232) at mem/q_malloc.c:441
#3  0x000000000060533e in free_hdr_field_lst (hf=0x7efb557e36c0) at parser/hf.c:213
#4  0x000000000062bd99 in free_sip_msg (msg=0x7ffcc50d45c0) at parser/msg_parser.c:717
#5  0x00007efc519cd316 in msg_apply_changes_f (msg=0x7ffcc50d45c0, str1=0x4232 <error: Cannot access memory at address 0x4232>, 
    str2=0x6 <error: Cannot access memory at address 0x6>) at textopsx.c:203
#6  0x000000000055e920 in do_action (h=0x7ffcc50d4480, a=0x7efc5cb77080, msg=0x7ffcc50d45c0) at action.c:1059
#7  0x000000000055d558 in run_actions (h=0x4232, a=0x4232, msg=0x6) at action.c:1548
#8  0x000000000055ee56 in do_action (h=0x7ffcc50d4480, a=0x7efc5cb771c8, msg=0x7ffcc50d45c0) at action.c:1048
#9  0x000000000055d558 in run_actions (h=0x4232, a=0x4232, msg=0x6) at action.c:1548
#10 0x000000000055f013 in do_action (h=0x7ffcc50d4480, a=0x7efc5d307218, msg=0x7ffcc50d45c0) at action.c:677
#11 0x000000000055d558 in run_actions (h=0x4232, a=0x4232, msg=0x6) at action.c:1548
#12 0x000000000055ee56 in do_action (h=0x7ffcc50d4480, a=0x7efc5ce6ef38, msg=0x7ffcc50d45c0) at action.c:1048
#13 0x000000000055d558 in run_actions (h=0x4232, a=0x4232, msg=0x6) at action.c:1548
#14 0x000000000055f013 in do_action (h=0x7ffcc50d4480, a=0x7efc5d307218, msg=0x7ffcc50d45c0) at action.c:677
#15 0x000000000055d558 in run_actions (h=0x4232, a=0x4232, msg=0x6) at action.c:1548
#16 0x000000000055f013 in do_action (h=0x7ffcc50d4480, a=0x7efc5d307218, msg=0x7ffcc50d45c0) at action.c:677
#17 0x000000000055d558 in run_actions (h=0x4232, a=0x4232, msg=0x6) at action.c:1548
#18 0x000000000055ee56 in do_action (h=0x7ffcc50d4480, a=0x7efc5da6da88, msg=0x7ffcc50d45c0) at action.c:1048
#19 0x000000000055d558 in run_actions (h=0x4232, h at entry=0x7ffcc50d4480, a=0x4232, a at entry=0x7efc5da4f3b0, msg=0x6, msg at entry=0x7ffcc50d45c0)
    at action.c:1548
#20 0x00000000005693f5 in run_top_route (a=0x7efc5da4f3b0, msg=0x7ffcc50d45c0, c=<optimized out>) at action.c:1634
#21 0x00007efc5a679412 in t_continue (hash_index=0, label=3305981376, route=0x7efc5da4f3b0) at t_suspend.c:272
#22 0x00007efb53138071 in send_to_script (val=0x4232, req_cmd=0x4232) at janssonrpc_io.c:149
#23 0x00007efb5313eb7e in handle_response (response=0x7efb533567d0 <jsontoval>) at janssonrpc_io.c:690
#24 0x00007efb531403e8 in handle_netstring (server=0x7efb554a16d0) at janssonrpc_io.c:919
#25 0x00007efb53141223 in bev_read_cb (bev=0x4232, arg=0x7efb554a16d0) at janssonrpc_io.c:975
#26 0x00007efb52eeb2aa in ?? () from /usr/lib/x86_64-linux-gnu/libevent-2.0.so.5
#27 0x00007efb52ee03dc in event_base_loop () from /usr/lib/x86_64-linux-gnu/libevent-2.0.so.5
#28 0x00007efb53139fba in jsonrpc_io_child_process (cmd_pipe=6) at janssonrpc_io.c:109
#29 0x0000000000522f0b in init_mod_child (m=0x4232, rank=16946) at sr_module.c:927
#30 0x0000000000522e54 in init_mod_child (m=0x4232, rank=16946) at sr_module.c:924
#31 0x0000000000522e54 in init_mod_child (m=0x4232, rank=16946) at sr_module.c:924
#32 0x0000000000521cec in main_loop () at main.c:1654
```

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/676
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sip-router.org/pipermail/sr-dev/attachments/20160617/eb86e7ce/attachment.html>