28 May
2009
28 May
'09
1:54 p.m.
Bugs item #2797928, was opened at 2009-05-28 15:54
Message generated for change (Tracker Item Submitted) made by axlh
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=743020&aid=279792…
Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: modules
Group: ver 1.5.x
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Alex Hermann (axlh)
Assigned to: Nobody/Anonymous (nobody)
Summary: Segfaults in dialog_update_db
Initial Comment:
dialog_update_db() is very crashy. It doesn't do any sanity checks on pointers and as
a consequence crashes a lot.
I've seen at least 2 occasions at which is crashes:
1) Calling dlg_manage() on a non-invite message
2) Worse, on an invalid message. When a 200 OK is missing a contact header, I get error
messages from populate_leg_info():
ERROR:dialog:populate_leg_info: bad sip message or missing Contact hdr
ERROR:dialog:dlg_onreply: could not add further info to the dialog
But afterwards dialog_update_db segfaults on an invalid bind_addr, from the backtrace:
(gdb) bt
#0 0xb783c41a in dialog_update_db (ticks=771000, param=0x0) at dlg_db_handler.c:629
#1 0x080a9726 in start_timer_processes () at timer.c:282
#2 0x08069b38 in main (argc=10, argv=0xbfc6f2d4) at main.c:816
Line 629 is for my version: SET_STR_VALUE(values+8,
cell->bind_addr[DLG_CALLEE_LEG]->sock_str);
(gdb) bt full
<snip>
{type = DB_STR, nul = 0, free = -1282894544, val = {int_val = 178, ll_val =
-5201380350948802382, double_val = -7.7990737395388139e-40, time_val = 178, string_val =
0xb2 "", str_val = {s = 0xb2 "", len = -1211040735}, blob_val = {s =
0xb2 "", len = -1211040735}, bitmap_val = 178}}
<snip>
----------------------------------------------------------------------
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=743020&aid=279792…