Hello
lately we have seen some crashes in Kamailio 4.2.1. After some
investigation we found that the crashes happen when get_redirects(*) is
called in a failure_route on a 302 message containing a Contact header
like this:
Contact: <>
It's easy to duplicate. This is a sample backtrace:
Core was generated by `/usr/local/kamailio/sbin/kamailio -P
/var/run/kamailio/kamailio.pid -f'.
Program terminated with signal 11, Segmentation fault.
#0 0x00000000004737dc in append_branch (msg=0x0, uri=0x7f4cfc3ba308,
dst_uri=0x0, path=0x0, q=10, flags=0, force_socket=0x0,
instance=0x7f4cf8ae3b70, reg_id=0, ruid=0x7f4cf8ae3b70,
location_ua=0x7f4cf8ae3b70)
at dset.c:344
344 if (msg->new_uri.s)
Missing separate debuginfos, use: debuginfo-install
glibc-2.12-1.149.el6.x86_64 pcre-7.8-6.el6.x86_64
(gdb) bt
#0 0x00000000004737dc in append_branch (msg=0x0, uri=0x7f4cfc3ba308,
dst_uri=0x0, path=0x0, q=10, flags=0, force_socket=0x0,
instance=0x7f4cf8ae3b70, reg_id=0, ruid=0x7f4cf8ae3b70,
location_ua=0x7f4cf8ae3b70)
at dset.c:344
#1 0x00007f4cf88dc843 in shmcontact2dset (req=0x7f4cfb56fb80,
sh_rpl=0x7f4cfc43f080, max=-1, reason=0x0, bflags=0) at rd_funcs.c:303
#2 0x00007f4cf88da242 in get_redirect (msg=0x7f4cfb56fb80, maxt=0,
maxb=0, reason=0x0, bflags=0) at rd_funcs.c:106
#3 0x00007f4cf88e036b in w_get_redirect2 (msg=0x7f4cfb56fb80,
max_c=0x0, reason=0x0) at redirect.c:369
#4 0x00007f4cf88e03ba in w_get_redirect1 (msg=0x7f4cfb56fb80,
max_c=0x0, foo=0x0) at redirect.c:380
#5 0x000000000041d329 in do_action (h=0x7fffcf6c27e0, a=0x7f4cfc4144f8,
msg=0x7f4cfb56fb80) at action.c:1094
#6 0x00000000004299b1 in run_actions (h=0x7fffcf6c27e0,
a=0x7f4cfc4141e0, msg=0x7f4cfb56fb80) at action.c:1583
#7 0x000000000041d204 in do_action (h=0x7fffcf6c27e0, a=0x7f4cfc41f3e8,
msg=0x7f4cfb56fb80) at action.c:1079
#8 0x00000000004299b1 in run_actions (h=0x7fffcf6c27e0,
a=0x7f4cfc412028, msg=0x7f4cfb56fb80) at action.c:1583
#9 0x000000000042a0de in run_top_route (a=0x7f4cfc412028,
msg=0x7f4cfb56fb80, c=0x0) at action.c:1669
#10 0x00007f4cfb2f468e in run_failure_handlers (t=0x7f4c01c524a0,
rpl=0x7f4cfc43f080, code=302, extra_flags=64) at t_reply.c:1051
#11 0x00007f4cfb2f72ae in t_should_relay_response (Trans=0x7f4c01c524a0,
new_code=302, branch=0, should_store=0x7fffcf6c2b30,
should_relay=0x7fffcf6c2b34, cancel_data=0x7fffcf6c2d80,
reply=0x7f4cfc43f080)
at t_reply.c:1406
#12 0x00007f4cfb2f9e0f in relay_reply (t=0x7f4c01c524a0,
p_msg=0x7f4cfc43f080, branch=0, msg_status=302,
cancel_data=0x7fffcf6c2d80, do_put_on_wait=1) at t_reply.c:1809
#13 0x00007f4cfb2fe40c in reply_received (p_msg=0x7f4cfc43f080) at
t_reply.c:2493
#14 0x000000000048bb02 in do_forward_reply (msg=0x7f4cfc43f080, mode=0)
at forward.c:783
#15 0x000000000048d13d in forward_reply (msg=0x7f4cfc43f080) at
forward.c:885
#16 0x0000000000507978 in receive_msg (
buf=0xa6e740 "SIP/2.0 302 Redirect Request\r\nVia: SIP/2.0/UDP
79.170.68.186;branch=z9hG4bK1472.15af91d174dcfc95d1b65dfeebfde5aa.0\r\nVia:
SIP/2.0/UDP
79.170.64.167:5080;received=79.170.64.167;rport=5080;branch=z9hG4bK"...,
len=529, rcv_info=0x7fffcf6c31a0) at receive.c:275
#17 0x000000000060679e in udp_rcv_loop () at udp_server.c:521
#18 0x00000000004a5ab3 in main_loop () at main.c:1629
#19 0x00000000004aad46 in main (argc=13, argv=0x7fffcf6c35b8) at
main.c:2561
Can you take a look?
Thanks
Javi
Module: kamailio
Branch: 4.1
Commit: 75e862dbca42de5ded8cb6cddbbeba823c46270c
URL: https://github.com/kamailio/kamailio/commit/75e862dbca42de5ded8cb6cddbbeba8…
Author: Daniel-Constantin Mierla <miconda(a)gmail.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2015-02-05T11:32:47+01:00
core: safety check for append_branch() when called with no uri and no msg
- uri or msg parameter must be given, otherwise the new address cannot
be set
- get_redirects() from uac_redirect can execute this function with both
parameters invalid in case of invalid contact, reported by Javi
Gallart
(cherry picked from commit 2c4ed5922a2322f3b5059f6264884acfb5dec97f)
(cherry picked from commit a90e73327cccb5259af08cbf93f2a1b793a0ca2e)
---
Modified: dset.c
---
Diff: https://github.com/kamailio/kamailio/commit/75e862dbca42de5ded8cb6cddbbeba8…
Patch: https://github.com/kamailio/kamailio/commit/75e862dbca42de5ded8cb6cddbbeba8…
---
diff --git a/dset.c b/dset.c
index 4b886bd..ccb0abe 100644
--- a/dset.c
+++ b/dset.c
@@ -341,6 +341,11 @@ int append_branch(struct sip_msg* msg, str* uri, str* dst_uri, str* path,
/* if not parameterized, take current uri */
if (uri==0 || uri->len==0 || uri->s==0) {
+ if(msg==NULL) {
+ LM_ERR("no new uri and no msg to take r-uri\n");
+ ser_error = E_INVALID_PARAMS;
+ return -1;
+ }
if (msg->new_uri.s)
luri = msg->new_uri;
else
Module: kamailio
Branch: 4.2
Commit: a90e73327cccb5259af08cbf93f2a1b793a0ca2e
URL: https://github.com/kamailio/kamailio/commit/a90e73327cccb5259af08cbf93f2a1b…
Author: Daniel-Constantin Mierla <miconda(a)gmail.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2015-02-05T11:30:23+01:00
core: safety check for append_branch() when called with no uri and no msg
- uri or msg parameter must be given, otherwise the new address cannot
be set
- get_redirects() from uac_redirect can execute this function with both
parameters invalid in case of invalid contact, reported by Javi
Gallart
(cherry picked from commit 2c4ed5922a2322f3b5059f6264884acfb5dec97f)
---
Modified: dset.c
---
Diff: https://github.com/kamailio/kamailio/commit/a90e73327cccb5259af08cbf93f2a1b…
Patch: https://github.com/kamailio/kamailio/commit/a90e73327cccb5259af08cbf93f2a1b…
---
diff --git a/dset.c b/dset.c
index 8e7410e..9c28445 100644
--- a/dset.c
+++ b/dset.c
@@ -341,6 +341,11 @@ int append_branch(struct sip_msg* msg, str* uri, str* dst_uri, str* path,
/* if not parameterized, take current uri */
if (uri==0 || uri->len==0 || uri->s==0) {
+ if(msg==NULL) {
+ LM_ERR("no new uri and no msg to take r-uri\n");
+ ser_error = E_INVALID_PARAMS;
+ return -1;
+ }
if (msg->new_uri.s)
luri = msg->new_uri;
else
Module: kamailio
Branch: master
Commit: 2c4ed5922a2322f3b5059f6264884acfb5dec97f
URL: https://github.com/kamailio/kamailio/commit/2c4ed5922a2322f3b5059f6264884ac…
Author: Daniel-Constantin Mierla <miconda(a)gmail.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2015-02-05T11:29:26+01:00
core: safety check for append_branch() when called with no uri and no msg
- uri or msg parameter must be given, otherwise the new address cannot
be set
- get_redirects() from uac_redirect can execute this function with both
parameters invalid in case of invalid contact, reported by Javi
Gallart
---
Modified: dset.c
---
Diff: https://github.com/kamailio/kamailio/commit/2c4ed5922a2322f3b5059f6264884ac…
Patch: https://github.com/kamailio/kamailio/commit/2c4ed5922a2322f3b5059f6264884ac…
---
diff --git a/dset.c b/dset.c
index 7ccdf53..2fb3b70 100644
--- a/dset.c
+++ b/dset.c
@@ -352,6 +352,11 @@ int append_branch(struct sip_msg* msg, str* uri, str* dst_uri, str* path,
/* if not parameterized, take current uri */
if (uri==0 || uri->len==0 || uri->s==0) {
+ if(msg==NULL) {
+ LM_ERR("no new uri and no msg to take r-uri\n");
+ ser_error = E_INVALID_PARAMS;
+ return -1;
+ }
if (msg->new_uri.s)
luri = msg->new_uri;
else
Hello,
I am planning to release a new version from previous stable branch -
4.1. Most likely it will be Thursday or Friday this week. If there is
something important to take in consideration for that version, reply to
sr-dev mailing list.
Cheers,
Daniel
--
Daniel-Constantin Mierla
http://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda
Module: kamailio
Branch: master
Commit: 8caaeff0a82db141e40e118597f667bcb01f1fbe
URL: https://github.com/kamailio/kamailio/commit/8caaeff0a82db141e40e118597f667b…
Author: Jason Penton <jason.penton(a)gmail.com>
Committer: Jason Penton <jason.penton(a)gmail.com>
Date: 2015-02-05T11:51:18+02:00
modules/ims_charging: release S-CSCF contact (unref) after use
- failing to do this results in contact never being freed
---
Modified: modules/ims_charging/dialog.c
---
Diff: https://github.com/kamailio/kamailio/commit/8caaeff0a82db141e40e118597f667b…
Patch: https://github.com/kamailio/kamailio/commit/8caaeff0a82db141e40e118597f667b…
---
diff --git a/modules/ims_charging/dialog.c b/modules/ims_charging/dialog.c
index 0f8beb8..f564fcb 100644
--- a/modules/ims_charging/dialog.c
+++ b/modules/ims_charging/dialog.c
@@ -236,6 +236,7 @@ void remove_dlg_data_from_contact(struct dlg_cell *dlg, int type, struct dlg_cb_
LM_DBG("This contact: <%.*s> is not in usrloc, ignore - NOTE: You need S-CSCF usrloc set to match_mode CONTACT_PORT_IP_ONLY\n", impu_data->contact.len, impu_data->contact.s);
} else {//contact exists so add dialog data to it
ul.remove_dialog_data_from_contact(ucontact, dlg->h_entry, dlg->h_id);
+ ul.release_ucontact(ucontact);
}
}
ul.unlock_udomain(domain_t, &impu_data->identity);
@@ -277,6 +278,7 @@ void add_dlg_data_to_contact(struct dlg_cell *dlg, int type, struct dlg_cb_param
LM_DBG("This contact: <%.*s> is not in usrloc, ignore - NOTE: You need S-CSCF usrloc set to match_mode CONTACT_PORT_IP_ONLY\n", impu_data->contact.len, impu_data->contact.s);
} else {//contact exists so add dialog data to it
ul.add_dialog_data_to_contact(ucontact, dlg->h_entry, dlg->h_id);
+ ul.release_ucontact(ucontact);
}
}
ul.unlock_udomain(domain_t, &impu_data->identity);