[Serusers] I can't append a head field in the tm module

[szj]

Hi:

  I want to insert a header field without the script. Instead I
insert it in the tm module's t_relay() function. Next is my code.
The first time I use the pkg_malloc(), but ser report that:
 BUG: qm_*: prev. fragm. tail overwritten(c0c0c000, abcdefed)
so I changed the pkg_malloc to the shm_malloc();
this time the error happend again in the different place.

    typedef  int(*local_fp)(struct sip_msg *msg, str *txt, int flags);
    str *str1;
    char *tmp =  "P-Security-Nobody:  this is a test header for \r\n";
    local_fp append_to_reply = NULL;

    str1 = (str*)shm_malloc(sizeof(str));
    if(str1)
    {
      str1->len = strlen(tmp);
      str1->s = (char*)shm_malloc(str1->len);
      strcpy(str1->s, tmp);
      append_to_reply = (local_fp)find_export("append_hf", 1, 0);
      if(append_to_reply){
        DBG("DEBUG: SUNZJ find apppend_to_reply\n");
        append_to_reply(p_msg, str1, NULL);
      }
    }

the next is gdb's output.
Program received signal SIGABRT, Aborted.
[Switching to Thread -1208486208 (LWP 6439)]
0x00ad77a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
(gdb)
(gdb) where
#0  0x00ad77a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1  0x00b1b955 in raise () from /lib/tls/libc.so.6
#2  0x00b1d319 in abort () from /lib/tls/libc.so.6
#3  0x0808cb9d in qm_debug_frag (qm=0xb5f7e000, f=0x6) at mem/q_malloc.c:156
#4  0x0808d1ab in qm_malloc (qm=0xb5f7e000, size=4107, file=0x13fb49 
"h_table.c", func=0x13fb1e "build_cell", line=231)
    at mem/q_malloc.c:379
#5  0x0011b654 in build_cell (p_msg=0x814bec0) at shm_mem.h:135
#6  0x0012c23e in t_newtran (p_msg=0x814bec0) at t_lookup.c:988
#7  0x00123f4e in t_relay_to (p_msg=0x814bec0, proxy=0x0, proto=0, 
replicate=0) at t_funcs.c:241
#8  0x0012f450 in w_t_relay (p_msg=0x814bec0, _foo=0x0, _bar=0x0) at 
tm.c:893
#9  0x0804fe41 in do_action (a=0x814a4ac, msg=0x814bec0) at action.c:611
#10 0x08050bad in run_actions (a=0x814a4ac, msg=0x814bec0) at action.c:719
#11 0x08074fe8 in eval_elem (e=0x814a4fc, msg=0x814bec0) at route.c:605
#12 0x08075482 in eval_expr (e=0x814a4fc, msg=0x814bec0) at route.c:654
#13 0x080754be in eval_expr (e=0x814a540, msg=0x814bec0) at route.c:670
#14 0x0804edd5 in do_action (a=0x814a684, msg=0x814bec0) at action.c:587
#15 0x08050bad in run_actions (a=0x814a684, msg=0x814bec0) at action.c:719
#16 0x0805019f in do_action (a=0x814a3ac, msg=0x814bec0) at action.c:376
#17 0x08050bad in run_actions (a=0x814a3ac, msg=0x814bec0) at action.c:719
#18 0x0806de90 in receive_msg (
    buf=0x80db480 "INVITE sip:862222 at sip.suntest.com SIP/2.0\r\nVia: 
SIP/2.0/UDP 192.168.0.19:5500;branch=z9hG4bK958088909\r\nFrom: 
<sip:861111 at sip.suntest.com>;tag=1137899792;tag=1613933050\r\nTo: 
<sip:862222 at sip.suntest.com"..., len=1018,
    rcv_info=0xbffe1590) at receive.c:162
#19 0x080858dc in udp_rcv_loop () at udp_server.c:458
#20 0x0805d77f in main_loop () at main.c:1032
#21 0x0805ece5 in main (argc=2, argv=0xbffe1754) at main.c:1569

  Anyone who tell me what the problem is will be appreciated.
  
  Thanks for your kind help
  Best Regards.

Sun Zongjun