[sr-dev] negative values in branch picking priority - integer overflow

Hi, I think I discovered a bug in t_pick_branch, lines 1194 if (get_prio(inc_code, rpl)<get_prio(best_s, rpl)) { ... 1210 get_prio(t->uac[b].last_received, rpl)<get_prio(best_s, rpl) ) the second argument of get_prio() does ALWAYS corresponds to the branch b, which is iterated within the loop: rpl = t->uac[b].reply; The "best_s"-branch may have a different rpl - nevertheless, get_prio() is always called with the same "rpl"! So e.g. it can happen, that in the first iteration (best_s is 0) if the branch "b" has a faked reply (=> rpl== FAKED_REPLY) and the module parameter "faked_reply_prio" is +1000, get_prio() does the following 1168 if (rpl == FAKED_REPLY) { 1169 /* Add faked_reply penalty */ 1170 return prio + faked_reply_prio; => 32000 + 1000 !!! overflow !!! rpl == FAKED_REPLY because get_prio(best_s, rpl) is called with the currently-iterated rpl parameter! In my opinion it needs to be stored for the best_s, whether it has a FAKED_REPLY or not, best_s_rpl or something.... Cheers Jasmin