[SR-Users] Kamailio 1.5.4 crash

[gwillingham at comcast.net]

We were experiencing the issue with 1.5.4 released version, we upgraded from svn and the issue still persists.  I have a backtrace from both versions. 



I agree it is a free of a null pointer, but the if(hf->parsed) should be the test for NULL, and only execute code if not NULL.  However this test is failing.  




----- Original Message ----- 
From: "Henning Westerholt" <henning.westerholt at 1und1.de> 
To: sr-users at lists.sip-router.org 
Cc: "Alex Balashov" <abalashov at evaristesys.com>, gwillingham at comcast.net 
Sent: Monday, August 30, 2010 11:45:11 AM 
Subject: Re: [SR-Users] Kamailio 1.5.4 crash 

On Monday 30 August 2010, Alex Balashov wrote: 
> On 08/30/2010 11:33 AM, gwillingham at comcast.net wrote: 
> > output from gdb shows hf->parsed to be NULL, however the call to 
> > free_to(hf->parsed) is being called, from there bad things happen. 
> 
> Sounds like a double free(), or a free() of something that was never 
> allocated. 

Hello Gene, 

1.5.4 was released in February, i think - do you use the version from tar.gz? 
I've checked the file in question, there were one fix in the last month: 

r6036 | miconda | 2010-07-30 20:18:33 +0200 (Fr, 30 Jul 2010) | 4 lines 
- fix off-by-one bug for quoted parameter values in parse_to 
- patch by Alex Hermann, SF#3035382 

which maybe could help you here. I'd suggest that you extract the SIP message 
in question from the backtrace (receive_msg, buf) and then try to reproduce 
the crash. If it crash again, just update to the latest 1.5 branch state, and 
see if it crashes again. It contains some more fixes, one or two also could 
cause crashes in some special conditions. 

Cheers, 

Henning 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sip-router.org/pipermail/sr-users/attachments/20100830/8a8ca515/attachment.htm>