<!--
Kamailio Project uses GitHub Issues only for bugs in the code or feature requests.
If you have questions about using Kamailio or related to its configuration file,
ask on sr-users mailing list:
* http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
If you have questions about developing extensions to Kamailio or its existing
C code, ask on sr-dev mailing list
* http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-dev
Please try to fill this template as much as possible for any issue. It helps the
developers to troubleshoot the issue.
If you submit a feature request (or enhancement), you can delete the text of
the template and only add the description of what you would like to be added.
If there is no content to be filled in a section, the entire section can be removed.
You can delete the comments from the template sections when filling.
You can delete next line and everything above before submitting (it is a comment).
-->
### Description
<!--
Explain what you did, what you expected to happen, and what actually happened.
-->
When processing a multipart INVITE using the rtpengine module. The rtpengine_offer configuration function (called with default arguments) is stripping all bodies except the application/sdp MIME type body.
### Troubleshooting
#### Reproduction
<!--
If the issue can be reproduced, describe how it can be done.
-->
A client is sending an INVITE through a kamailio proxy paired with a rtpengine.
```
Client Proxy Server
x INVITE (SDP) x x x
x qqqqqqqqqqqqqqqqqqqqqqqqqq> x x x
x 100 Trying x x x
x <qqqqqqqqqqqqqqqqqqqqqqqqqq x x x
x x x INVITE (SDP) x
x x x qqqqqqqqqqqqqqqqqqqqqqqqqq> x
x x x 100 Trying x
x x x <qqqqqqqqqqqqqqqqqqqqqqqqqq x
x x x x
x x x x
x x x x
x x x x
x x x x
x x x x
x x x 200 OK (SDP) x
x x x <qqqqqqqqqqqqqqqqqqqqqqqqqq x
x 200 OK (SDP) x x x
x <qqqqqqqqqqqqqqqqqqqqqqqqqq x x x
```
The INVITE contains a application/sdp body and one or several other bodies of different MIME types.
When the INVITE is going out of the proxy, all other bodies except the application/sdp MIME are filtered out.
While The INVITE "Content-Type" header is still fixed to :
`Content-Type: multipart/mixed;boundary="[boundary value]"`
RTP Engine receives only the SDP body on its socket and is rewritting well the RTP ports.
#### Debugging Data
<!--
If you got a core dump, use gdb to extract troubleshooting data - full backtrace,
local variables and the list of the code at the issue location.
gdb /path/to/kamailio /path/to/corefile
bt full
info locals
list
If you are familiar with gdb, feel free to attach more of what you consider to
be relevant.
-->
```
(paste your debugging data here)
```
#### Log Messages
<!--
Check the syslog file and if there are relevant log messages printed by Kamailio, add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site).
-->
```
(paste your log messages here)
```
#### SIP Traffic
<!--
If the issue is exposed by processing specific SIP messages, grab them with ngrep or save in a pcap file, then add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site).
-->
```
(paste your sip traffic here)
```
### Possible Solutions
<!--
If you found a solution or workaround for the issue, describe it. Ideally, provide a pull request with a fix.
-->
This issue has been introduced by the following commit : 36cb753441a78bd13ded119cd468f32623f09fbf.
rtpengine.c :
``` diff
@@ -3328,6 +3328,7 @@ rtpengine_offer_answer(struct sip_msg *msg, const char *flags, int op, int more)
str body, newbody;
struct lump *anchor;
pv_value_t pv_val;
+ str cur_body = {0, 0};
dict = rtpp_function_call_ok(&bencbuf, msg, op, flags, &body);
if (!dict)
@@ -3357,7 +3358,12 @@ rtpengine_offer_answer(struct sip_msg *msg, const char *flags, int op, int more)
pkg_free(newbody.s);
} else {
- anchor = del_lump(msg, body.s - msg->buf, body.len, 0);
+ /* get the body from the message as body ptr may have changed */
+ cur_body.len = 0;
+ cur_body.s = get_body(msg);
+ cur_body.len = msg->buf + msg->len - cur_body.s;
+
+ anchor = del_lump(msg, cur_body.s - msg->buf, cur_body.len, 0);
if (!anchor) {
LM_ERR("del_lump failed\n");
goto error_free;
```
If this commit is removed, the previous behavior is restored.
This commit fixes a segfault: "rtpengine: fixed segfault when using read_sdp_pv", so it appears to me that this may be useful.
For, now I am not seeing why this is happening.
### Additional Information
* **Kamailio Version** - output of `kamailio -v`
seen on:
```
version: kamailio 5.1.0 (x86_64/linux)
flags: STATS: Off, EXTRA_DEBUG, USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MEM, SHM_MMAP, PKG_MALLOC, Q_MALLOC, F_MALLOC, TLSF_MALLOC, DBG_SR_MEMORY, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLACKLIST, HAVE_RESOLV_RES
ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535, DEFAULT PKG_SIZE 8MB
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
id: unknown
compiled on 15:29:43 Feb 8 2018 with gcc 4.8.4
```
but I think that the same behavior will be seen on master.
* **Operating System**:
<!--
Details about the operating system, the type: Linux (e.g.,: Debian 8.4, Ubuntu 16.04, CentOS 7.1, ...), MacOS, xBSD, Solaris, ...;
Kernel details (output of `uname -a`)
-->
```
(paste your output here)
```
--
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/1434
### Description
When starting my kamailio with my complete kamailio.cfg, I have crash reporting
*** Error in `/usr/sbin/kamailio': realloc(): invalid next size: 0x0000000001060980 ***
The issue looks to be related to using "app_lua" module. However, the issue don't
always show up. If I remove ONE modules, it won't crash. I've been trying to get a
simple config to crash, but I have to keep many modules to reproduce the crash.
The crash is happening line 228 of app_lua_api.c:
if(luaL_dostring(L, "sr.probe()")!=0)
### Troubleshooting
Can't start kamailio.
#### Reproduction
I have attached my minimal kamailio4.cfg file to reproduce the crash. I have removed
my DBURL credentials.
[kamailio4.cfg.txt](https://github.com/kamailio/kamailio/files/1707085/kamai…
I'm starting kamailio with:
/usr/sbin/kamailio -D -f kamailio4.cfg -e -E -ddd
#### Debugging Data
Core was generated by `/usr/sbin/kamailio -D -f kamailio4.cfg -e -E -ddd'.
Program terminated with signal SIGABRT, Aborted.
#0 0x00007f8ecfb62067 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0 0x00007f8ecfb62067 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1 0x00007f8ecfb63448 in __GI_abort () at abort.c:89
#2 0x00007f8ecfba01b4 in __libc_message (do_abort=do_abort@entry=1, fmt=fmt@entry=0x7f8ecfc95210 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#3 0x00007f8ecfba598e in malloc_printerr (action=1, str=0x7f8ecfc9142a "realloc(): invalid next size", ptr=<optimized out>) at malloc.c:4996
#4 0x00007f8ecfba876b in _int_realloc (av=av@entry=0x7f8ecfed2620 <main_arena>, oldp=oldp@entry=0x1060970, oldsize=oldsize@entry=736, nb=nb@entry=1552) at malloc.c:4234
#5 0x00007f8ecfba9769 in __GI___libc_realloc (oldmem=0x1060980, bytes=1536) at malloc.c:3029
#6 0x00007f8ec324acae in luaM_realloc_ (L=L@entry=0x10605c0, block=block@entry=0x1060980, osize=720, nsize=nsize@entry=1536) at lmem.c:79
#7 0x00007f8ec32469aa in luaD_reallocstack (L=0x10605c0, newsize=90) at ldo.c:145
#8 0x00007f8ec324b66d in open_func (ls=ls@entry=0x7ffe459b9720, fs=fs@entry=0x7ffe459b9780) at lparser.c:350
#9 0x00007f8ec324e0b3 in luaY_parser (L=0x10605c0, z=0x7ffe459b9bf0, buff=<optimized out>, name=<optimized out>) at lparser.c:388
#10 0x00007f8ec3246cd1 in f_parser (L=L@entry=0x10605c0, ud=ud@entry=0x7ffe459b9ba0) at ldo.c:498
#11 0x00007f8ec324692e in luaD_rawrunprotected (L=L@entry=0x10605c0, f=f@entry=0x7f8ec3246c80 <f_parser>, ud=ud@entry=0x7ffe459b9ba0) at ldo.c:116
#12 0x00007f8ec32477bb in luaD_pcall (L=L@entry=0x10605c0, func=func@entry=0x7f8ec3246c80 <f_parser>, u=u@entry=0x7ffe459b9ba0, old_top=672, ef=<optimized out>) at ldo.c:464
#13 0x00007f8ec32478c2 in luaD_protectedparser (L=L@entry=0x10605c0, z=z@entry=0x7ffe459b9bf0, name=name@entry=0x7f8ec350547e "sr.probe()") at ldo.c:514
#14 0x00007f8ec3243528 in lua_load (L=0x10605c0, reader=reader@entry=0x7f8ec3252940 <getS>, data=data@entry=0x7ffe459b9c40, chunkname=0x7f8ec350547e "sr.probe()") at lapi.c:869
#15 0x00007f8ec3253d8c in luaL_loadbuffer (L=<optimized out>, buff=<optimized out>, size=<optimized out>, name=<optimized out>) at lauxlib.c:614
#16 0x00007f8ec34e87d7 in lua_sr_init_probe () from /usr/lib/x86_64-linux-gnu/kamailio/modules/app_lua.so
#17 0x00007f8ec347497d in ?? () from /usr/lib/x86_64-linux-gnu/kamailio/modules/app_lua.so
#18 0x0000000000549a00 in ?? ()
#19 0x0000000000549d92 in init_child ()
#20 0x00000000004214c8 in main_loop ()
#21 0x000000000042aae9 in main ()
(gdb)
(gdb) info locals
resultvar = 0
pid = 23353
selftid = 23353
#### Log Messages
I'm copy/pasting a few logs from the app_lua module. If you wish more, let me know.
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.hdr (hdr)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.jsonrpcs (jsonrpcs)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.kex (kex)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.tm (tm)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.tmx (tmx)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.sl (sl)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.tsilo (tsilo)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.rr (rr)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.pvx (pvx)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.maxfwd (maxfwd)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.registrar (registrar)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.textops (textops)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.siputils (siputils)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.sanity (sanity)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.acc (acc)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.uri_db (uri_db)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.auth (auth)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.auth_db (auth_db)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.permissions (permissions)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.alias_db (alias_db)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.domain (domain)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.presence (presence)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.presence_xml (presence_xml)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.nathelper (nathelper)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.rtpproxy (rtpproxy)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.tls (tls)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.pike (pike)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.htable (htable)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.xhttp (xhttp)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.websocket (websocket)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.sqlops (sqlops)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.cfgutils (cfgutils)
0(23353) DEBUG: app_lua [app_lua_sr.c:1975]: lua_sr_kemi_register_libs(): initializing kemi sub-module: KSR.app_lua (app_lua)
0(23353) DEBUG: app_lua [app_lua_sr.c:1978]: lua_sr_kemi_register_libs(): module 'KSR' has been initialized
#### SIP Traffic
Not applicable. The proxy crash before starting.
### Possible Solutions
I haven't been able to find any clue.
### Additional Information
I'm using a debian running jessie with debian package from http://deb.kamailio.org/kamailio51
I have installed liblua5.1-0-dbg to have more backtrace from the core dump.
$ /usr/sbin/kamailio -v
version: kamailio 5.1.1 (x86_64/linux)
flags: STATS: Off, USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MEM, SHM_MMAP, PKG_MALLOC, Q_MALLOC, F_MALLOC, TLSF_MALLOC, DBG_SR_MEMORY, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLACKLIST, HAVE_RESOLV_RES
ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535, DEFAULT PKG_SIZE 8MB
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
id: unknown
compiled with gcc 4.9.2
* **Operating System**:
$ uname -a
Linux sip.antisip.com 3.16.0-5-amd64 #1 SMP Debian 3.16.51-3+deb8u1 (2018-01-08) x86_64 GNU/Linux
Tks for looking at this!
Ay
--
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/1433