[sr-dev] git:5.1:8ce74832: tm: safty checks when destroying the tm cell

[Daniel-Constantin Mierla]

Module: kamailio
Branch: 5.1
Commit: 8ce748329be28b2a0f86f7711b03cdb696ee76d0
URL: https://github.com/kamailio/kamailio/commit/8ce748329be28b2a0f86f7711b03cdb696ee76d0

Author: Daniel-Constantin Mierla <miconda at gmail.com>
Committer: Daniel-Constantin Mierla <miconda at gmail.com>
Date: 2018-10-02T16:06:05+02:00

tm: safty checks when destroying the tm cell

(cherry picked from commit afb7ef77faab405a4da0c7f601f35358a1130238)

---

Modified: src/modules/tm/h_table.c

---

Diff:  https://github.com/kamailio/kamailio/commit/8ce748329be28b2a0f86f7711b03cdb696ee76d0.diff
Patch: https://github.com/kamailio/kamailio/commit/8ce748329be28b2a0f86f7711b03cdb696ee76d0.patch

---

diff --git a/src/modules/tm/h_table.c b/src/modules/tm/h_table.c
index 4ca611e6ab..4b1f0233f7 100644
--- a/src/modules/tm/h_table.c
+++ b/src/modules/tm/h_table.c
@@ -132,6 +132,10 @@ void free_cell_helper(
 
 	LM_DBG("freeing transaction %p from %s:%u\n", dead_cell, fname, fline);
 
+	if(dead_cell==NULL) {
+		return;
+	}
+
 	if(dead_cell->prev_c != NULL && dead_cell->next_c != NULL) {
 		if(likely(silent == 0)) {
 			LM_WARN("removed cell %p is still linked in hash table (%s:%u)\n",
@@ -153,6 +157,10 @@ void free_cell_helper(
 	if(dead_cell->fcount!=1) {
 		LM_WARN("unexpected fcount value: %d\n", dead_cell->fcount);
 	}
+	if(dead_cell->uac==NULL || dead_cell->uac!=T_UAC_PTR(dead_cell)) {
+		LM_WARN("unexpected tm cell content: %p\n", dead_cell);
+		return;
+	}
 
 	if(unlikely(has_tran_tmcbs(dead_cell, TMCB_DESTROY)))
 		run_trans_callbacks(TMCB_DESTROY, dead_cell, 0, 0, 0);