Module: sip-router
Branch: master
Commit: 5bdef817bdc2e3fcf4e68bf25bf1a97683f2269f
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=5bdef81…
Author: pd <peter.dunkley(a)crocodile-rcs.com>
Committer: pd <peter.dunkley(a)crocodile-rcs.com>
Date: Sun Nov 20 22:09:57 2011 +0000
modules_k/rr: Added new (C-API) function to add Record-Route based on advertised address
- You can already do something similar with record_route_preset, but that
function has some disadvantages. Double record-routing doesn't work and you
can't subsequently add parameters to the Record-Route header. This new
function doesn't have these disadvantages.
- Currently this is not exported to the configuration file. This may be worth
doing in the future.
- Feature added by Hugh Waite @ Crocodile RCS
---
modules_k/rr/README | 88 +++++++++++++++-----
modules_k/rr/api.c | 1 +
modules_k/rr/api.h | 1 +
modules_k/rr/doc/rr_devel.xml | 62 ++++++++++++++
modules_k/rr/record.c | 182 +++++++++++++++++++++++++++++++++++++++++
modules_k/rr/record.h | 16 ++++
6 files changed, 328 insertions(+), 22 deletions(-)
Diff: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commitdiff;h=5bd…
THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.
The following task has a new comment added:
FS#173 - Double Free -- Crash/Coredump and possible security vulnerability
User who did this - Timo Reimann (tr)
----------
Brandon,
I took a closer look at the information you gave: The problem seems to be related to reference counting (again).
I can see that the reference counter is decremented one time too often after the BYE message is received. In your scenario, things look like this:
Nov 17 09:40:04 kamailio /usr/local/sbin/kamailio[21598]: INFO: dialog [dlg_handlers.c:1132]: BYE successfully processed
Nov 17 09:40:04 kamailio /usr/local/sbin/kamailio[21598]: INFO: dialog [dlg_hash.c:597]: unref dlg 0x7f12fbd186c8 with 2 -> 2
Nov 17 09:40:04 kamailio /usr/local/sbin/kamailio[21598]: INFO: dialog [dlg_hash.c:579]: ref dlg 0x7f12fbd186c8 with 1 -> 3
Nov 17 09:40:04 kamailio /usr/local/sbin/kamailio[21598]: INFO: dialog [dlg_hash.c:597]: unref dlg 0x7f12fbd186c8 with 2 -> 1
In a reference call I did on my machine, you can see that the last unref operation is one less:
0(43729) NOTICE: dialog [dlg_handlers.c:1132]: BYE successfully processed
0(43729) NOTICE: dialog [dlg_hash.c:597]: unref dlg 0x101bb2080 with 2 -> 2
0(43729) NOTICE: dialog [dlg_hash.c:579]: ref dlg 0x101bb2080 with 1 -> 3
0(43729) NOTICE: dialog [dlg_hash.c:597]: unref dlg 0x101bb2080 with 1 -> 2
This leads to the situation where the dialog is erroneously removed prematurely. When the "canonical" dialog termination occurs later, removal is conducted for a second time, leading to a double free.
So the question is: What is happening in your scenario? Are you using any dialog module-related functions or touch the dialog in any way within the configuration script during processing of the BYE request? If so, which one(s)?
Also, could you please post your dialog modparams?
I assume you're using a latest build of 3.2 (that is, not the official release but a recent compiled build from the 3.2 branch). Is that correct?
----------
More information can be found at the following URL:
http://sip-router.org/tracker/index.php?do=details&task_id=173#comment368
You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.
THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.
The following task has a new comment added:
FS#173 - Double Free -- Crash/Coredump and possible security vulnerability
User who did this - Brandon Armstead (CRYY2010)
----------
version: kamailio 3.1.5 (x86_64/linux) 2bb8bb-dirty
flags: STATS: Off, USE_IPV6, USE_TCP, USE_TLS, TLS_HOOKS, USE_RAW_SOCKS, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MEM, SHM_MMAP, PKG_MALLOC, DBG_QM_MALLOC, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLACKLIST, HAVE_RESOLV_RES
ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535, PKG_SIZE 16MB
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
id: 2bb8bb -dirty
compiled on 18:55:59 Nov 19 2011 with gcc 4.3.2
**** This crash was produced on the above build ****
Also the syslog output I provided is with LM_DBG -> LM_INFO (LM_INFO SYSLOG)
Let me know if I can provide any additional information, thanks!
----------
More information can be found at the following URL:
http://sip-router.org/tracker/index.php?do=details&task_id=173#comment367
You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.