THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.
The following task has a new comment added:
FS#173 - Double Free -- Crash/Coredump and possible security vulnerability
User who did this - Bayan Towfiq (btowfiq)
----------
Sorry, this issue may also exist in 3.1 -- I have a friend who is having a very similar problem on 3.1.5 and the crashes are very frequent
----------
More information can be found at the following URL:
http://sip-router.org/tracker/index.php?do=details&task_id=173#comment364
You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.
THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.
The following task has a new comment added:
FS#173 - Double Free -- Crash/Coredump and possible security vulnerability
User who did this - Bayan Towfiq (btowfiq)
----------
I agree. It seems to have been a regression from 3.1 as this issue didn't exist in 3.1 with the same config.
Although long term this dependency needs to be refactored for the time being it's preventing a migration from 3.1 to 3.2 for production use.
Please let me know if you want any specific details on how the config is using TM module.
----------
More information can be found at the following URL:
http://sip-router.org/tracker/index.php?do=details&task_id=173#comment363
You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.
THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.
The following task has a new comment added:
FS#173 - Double Free -- Crash/Coredump and possible security vulnerability
User who did this - Daniel-Constantin Mierla (miconda)
----------
IMO, the fundamental issue here is the relation between dialog and tm module. Dialog stores own pointers in tm, expecting tm to clean up them in various cases. But tm has many exit cases and special handlings right now and any tm change in the future, based on the current dependencies, are just keeping dialog exposed to many issue. I plan to refactor this dialog-tm dependency, to avoid storing dialog pointers inside tm. Long term is safe bet, rather than just tracking and troubleshooting for corner cases (existing now or added in the future) of tm processing.
----------
More information can be found at the following URL:
http://sip-router.org/tracker/index.php?do=details&task_id=173#comment362
You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.
Module: sip-router
Branch: master
Commit: 7b612d999e061d05b60054e7749052d0abdf514c
URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=7b612d9…
Author: Daniel-Constantin Mierla <miconda(a)gmail.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: Thu Nov 17 23:14:32 2011 +0100
tm: free path if set first time in a branch route
---
modules/tm/t_fwd.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/modules/tm/t_fwd.c b/modules/tm/t_fwd.c
index 210601d..26bf7f3 100644
--- a/modules/tm/t_fwd.c
+++ b/modules/tm/t_fwd.c
@@ -374,6 +374,10 @@ static int prepare_new_uac( struct cell *t, struct sip_msg *i_req,
ignored) */
next_hop=&i_req->dst_uri;
}
+ /* no path vector initially, but now is set after branch route and
+ * callbacks execution */
+ if(i_req->path_vec.s!=0 && free_path==0)
+ free_path=1;
}else{
/* no branch route and no TMCB_REQUEST_FWDED callback => set
msg uri and path to the new values (if needed) */