[sr-dev] [tracker] Task opened: DOUBLE FREE / CRASH in parse_to.c

24 Nov 2011

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY.

A new Flyspray task has been opened.  Details are below. 

User who did this - Bayan Towfiq (btowfiq) 

Attached to Project - sip-router
Summary - DOUBLE FREE / CRASH in parse_to.c 
Task Type - Bug Report
Category - Core
Status - Assigned
Assigned To - Andrei Pelinescu-Onciul
Operating System - All
Severity - High
Priority - Normal
Reported Version - Development
Due in Version - Undecided
Due Date - Undecided
Details - BACKGROUND:
I had a crash in parse_to.c during onreply_route.  I've pasted the snippet of the
onreply_route, syslog errors, full backtrace, and also the ngrep showing the SIP
signaling.

70.xxx.xxx.xxx (the instance that crashed) is a sip proxy that is using dispatcher to
relay REGISTERs to a PRIMARY kamailio registrar (216.xxx.xxx.131).  If this PRIMARY
registrar is unresponsive 70.xxx.xxx.xxx sends the REGISTER to the SECONDARY registrar
(70.yyy.yyy.136)

After 70.xxx.xxx.xxx receives the 200OK to the REGISTER from 216.xxx.xxx.131 it replicates
a REGISTER message to 70.yyy.yyy.136, which is a backup registrar.

CRASH CIRCUMSTANCES:
In this case 216.xxx.xxx.131 had a delayed response to the REGISTER request which caused
70.xxx.xxx.xxx to send the REGISTER to the backup 70.yyy.yyy.136 registrar.  This
registration failed with 401 due to unknown challenge/nonce, but then 216.xxx.xxx.131 send
a delayed 200OK afterwards which crashed kamailio.

SYSLOG:
Nov 23 20:18:51 guru /usr/local/sbin/kamailio[23449]: ERROR: <core>
[parser/parse_to.c:463]: ERROR: parse_to_param: spitting out [,] in status 29
Nov 23 20:18:51 guru /usr/local/sbin/kamailio[23449]: : <core> [mem/q_malloc.c:457]:
BUG: qm_free: freeing already freed pointer, first free: <core>: parser/parse_to.c:
parse_to_param(513) - aborting
Nov 23 20:18:51 guru /usr/local/sbin/kamailio[23444]: ERROR: tm [t_reply.c:1192]: ERROR:
t_should_relay_response: status rewrite by UAS: stored: 408, received: 482
Nov 23 20:18:52 guru /usr/local/sbin/kamailio[23471]: : <core> [pass_fd.c:293]:
ERROR: receive_fd: EOF on 18
Nov 23 20:18:52 guru /usr/local/sbin/kamailio[23442]: ALERT: <core> [main.c:751]:
child process 23449 exited by a signal 6
Nov 23 20:18:52 guru /usr/local/sbin/kamailio[23442]: ALERT: <core> [main.c:754]:
core was generated

Snippet from kamailio config:

652 onreply_route[2] { #for registration replication
653     if($rm == "REGISTER" && t_check_status("200")
&& !isflagset(15)) {
654         setflag(15); #use this flag to make sure only one set of replications is sent
per 200
655         if(! defined $T_req($hdr(Expires))) {
656             $var(expires) = "";
657         } else {
658             $var(expires) = "Expires:
"+$T_req($hdr(Expires))+"\r\n";
659         };
660 
661         if( ! defined $T_req($hdr(Allow))) {
662             $var(allow) = "";
663         } else {
664             $var(allow) = "Allow: "+$T_req($hdr(Allow))+"\r\n";
665         };
666                                                                                       

667         if( ! defined $T_req($ua)) {
668             $var(useragent) = "";
669         } else {
670             $var(useragent) = "User-Agent: "+$T_req($ua)+"\r\n";
671         };
672 
673         $uac_req(all) = $null;
674         $uac_req(method)="REGISTER";
675         $uac_req(furi)=$T_req($fu);
676         $uac_req(turi)=$T_req($tu);
677         if(isflagset(5)) {
678             $uac_req(hdrs)="Contact: "+ $T_req($ct) +"\r\n"+
$var(expires) + $var(allow) + $var(useragent) +"Path: "+ $hdr(X-Path)
+"\r\nX-Auth-User: "+ $hdr(X-Auth-User) +"\r\nX-NAT: yes\r\nX-Replicated:
yes\r\n";
679         } else {
680             $uac_req(hdrs)="Contact: "+ $T_req($ct) +"\r\n"+
$var(expires) + $var(allow) + $var(useragent) +"Path: "+ $hdr(X-Path)
+"\r\nX-Auth-User: "+ $hdr(X-Auth-User) +"\r\nX-Replicated: yes\r\n";
681         };
682         $uac_req(body)="";
683 
684         
685         $uac_req(ruri)="sip:70.yyy.yyy.136";
686         $uac_req(ouri)="sip:70.yyy.yyy.136";
687         
688         
689 
690         uac_req_send();
691     }
692 }

(gdb) bt
#0  0x00007fc4f5801a75 in raise () from /lib/libc.so.6
#1  0x00007fc4f58055c0 in abort () from /lib/libc.so.6
#2  0x0000000000534708 in qm_free (qm=0x7fc4f53cd010, p=0x7fc4f54f8fa8, file=0x5d5a01
"<core>: parser/parse_to.c", func=0x5d6960 "free_to_params",
line=832) at mem/q_malloc.c:458
#3  0x000000000055041d in free_to_params (tb=<value optimized out>) at
parser/parse_to.c:832
#4  0x00007fc4f010a6d7 in tr_eval_tobody (msg=<value optimized out>, tp=<value
optimized out>, subtype=2, val=0x7fff8bd68840) at pv_trans.c:1141
#5  0x0000000000486369 in tr_exec (msg=0x7fc4f5575cf0, t=<value optimized out>,
v=0x7fff8bd68840) at pvapi.c:1550
#6  0x0000000000487b08 in pv_printf (msg=0x7fc4f5575cf0, list=<value optimized out>,
buf=<value optimized out>, len=0x7fff8bd68938) at pvapi.c:1237
#7  0x00000000004e1fea in get_str_fparam (dst=0x7fff8bd68930, msg=<value optimized
out>, param=0x7fc4f5517a48) at sr_module.c:1613
#8  0x00007fc4efcdb26d in add_hf_helper (msg=0x7fc4f5575cf0, str1=0x0, str2=0x0,
hfval=0x7fc4f5517a48, mode=0, hfanc=<value optimized out>) at textops.c:1516
#9  0x0000000000416c19 in do_action (h=0x7fff8bd69440, a=0x7fc4f551fc80, msg=<value
optimized out>) at action.c:1122
#10 0x000000000041e51b in run_actions (h=<value optimized out>, a=<value
optimized out>, msg=<value optimized out>) at action.c:1610
#11 0x0000000000417c67 in do_action (h=0x7fff8bd69440, a=0x7fc4f55201a0, msg=<value
optimized out>) at action.c:1111
#12 0x000000000041e51b in run_actions (h=<value optimized out>, a=<value
optimized out>, msg=<value optimized out>) at action.c:1610
#13 0x000000000041e7f2 in run_top_route (a=0x7fc4f55201a0, msg=0x7fc4f5575cf0, c=<value
optimized out>) at action.c:1683
#14 0x00007fc4f3b31659 in reply_received (p_msg=0x7fc4f5575cf0) at t_reply.c:2195
#15 0x0000000000452af5 in forward_reply (msg=0x7fc4f5575cf0) at forward.c:782
#16 0x0000000000498b5e in receive_msg (buf=0x8bb0c0 "SIP/2.0 200 OK\r\nVia:
SIP/2.0/UDP 70.xxx.xxx.xxx;branch=z9hG4bK880b.81b128becb98f2feed98b20cceba8b53.0\r\nVia:
SIP/2.0/UDP
192.168.1.8:5060;received=71.212.xxx.xxx;branch=z9hG4bK0fb2e054;rport=5060\r\nFrom"...,

    len=<value optimized out>, rcv_info=<value optimized out>) at
receive.c:267
#17 0x00000000005253b7 in udp_rcv_loop () at udp_server.c:544
#18 0x0000000000463564 in main_loop () at main.c:1585
#19 0x0000000000465dd2 in main (argc=11, argv=0x7fff8bd69c08) at main.c:2475

(gdb) bt full
#0  0x00007fc4f5801a75 in raise () from /lib/libc.so.6
No symbol table info available.
#1  0x00007fc4f58055c0 in abort () from /lib/libc.so.6
No symbol table info available.
#2  0x0000000000534708 in qm_free (qm=0x7fc4f53cd010, p=0x7fc4f54f8fa8, file=0x5d5a01
"<core>: parser/parse_to.c", func=0x5d6960 "free_to_params",
line=832) at mem/q_malloc.c:458
        f = 0x7fc4f54f8f78
        size = <value optimized out>
#3  0x000000000055041d in free_to_params (tb=<value optimized out>) at
parser/parse_to.c:832
        tp = 0x5b99
        foo = 0x0
#4  0x00007fc4f010a6d7 in tr_eval_tobody (msg=<value optimized out>, tp=<value
optimized out>, subtype=2, val=0x7fff8bd68840) at pv_trans.c:1141
        __FUNCTION__ = "tr_eval_tobody"
#5  0x0000000000486369 in tr_exec (msg=0x7fc4f5575cf0, t=<value optimized out>,
v=0x7fff8bd68840) at pvapi.c:1550
        r = 0
        i = 0x7fc4f5517bb0
#6  0x0000000000487b08 in pv_printf (msg=0x7fc4f5575cf0, list=<value optimized out>,
buf=<value optimized out>, len=0x7fff8bd68938) at pvapi.c:1237
        n = 10
        tok = {rs = {s = 0x8bb2de
"<sip:s@192.168.1.8>;q=1;expires=13;received=\"sip:71.212.xxx.xxx:5060\",
<sip:s@192.168.1.8>;q=1;expires=120;received=\"sip:71.212.xxx.xxx:5060\"\r\nContent-Length:
0\r\n\r\n", len = 141}, ri = 0, flags = 4}
        it = 0x7fc4f5517ae0
        cur = 0x7fc4f5405932
"sip:10.209.107.16:33049;natpub=sip:67.202.14.41:33049>\r\n"
#7  0x00000000004e1fea in get_str_fparam (dst=0x7fff8bd68930, msg=<value optimized
out>, param=0x7fc4f5517a48) at sr_module.c:1613
        val = {n = 0, s = {s = 0x0, len = -179209656}, re = 0x0}
        ret = <value optimized out>
        avp = <value optimized out>
        pv_val = {rs = {s = 0x7fff8bd69730 "", len = 0}, ri = -1948870864, flags
= 32767}
#8  0x00007fc4efcdb26d in add_hf_helper (msg=0x7fc4f5575cf0, str1=0x0, str2=0x0,
hfval=0x7fc4f5517a48, mode=0, hfanc=<value optimized out>) at textops.c:1516
        anchor = 0x7fc4f5429be0
        hf = <value optimized out>
        s = <value optimized out>
        len = <value optimized out>
        s0 = {s = 0x7fc4f5405928 "Contact:
<sip:10.209.107.16:33049;natpub=sip:67.202.14.41:33049>\r\n", len = 1024}
        __FUNCTION__ = "add_hf_helper"
#9  0x0000000000416c19 in do_action (h=0x7fff8bd69440, a=0x7fc4f551fc80, msg=<value
optimized out>) at action.c:1122
        ret = -5
        v = <value optimized out>
        dst = {send_sock = 0x7fc4f5575cf0, to = {s = {sa_family = 1, sa_data =
"\000\000\001\000\000\000\020\226\326\213\377\177\000"}, sin = {sin_family = 1,
sin_port = 0, sin_addr = {s_addr = 1}, sin_zero =
"\020\226\326\213\377\177\000"}, sin6 = {sin6_family = 1, 
              sin6_port = 0, sin6_flowinfo = 1, sin6_addr = {__in6_u = {__u6_addr8 =
"\020\226\326\213\377\177\000\000\235O\377\360\363|\207#", __u6_addr16 = {38416,
35798, 32767, 0, 20381, 61695, 31987, 9095}, __u6_addr32 = {2346096144, 32767, 4043263901,
596081907}}}, 
              sin6_scope_id = 2346096144}}, id = 32767, proto = -104 '\230',
send_flags = {f = 182 '\266', blst_imask = 66 'B'}}
        tmp = <value optimized out>
        new_uri = <value optimized out>
        end = <value optimized out>
        crt = <value optimized out>
        len = <value optimized out>
        user = <value optimized out>
        uri = {user = {s = 0x7 <Address 0x7 out of bounds>, len = -179180192},
passwd = {s = 0x7fc4f5575cf0 "N+\001", len = -1948871616}, host = {s =
0x7fff8bd68d48 "\001", len = 4961548}, port = {s = 0x7fc4f5575cf0
"N+\001", len = -1948870864}, params = {
            s = 0x7fff8bd69068 "\340QP\365\373\377\377\377\030QP\365\304\177",
len = -1948870392}, sip_params = {s = 0x7fff8bd69730 "", len = 4961745}, headers
= {s = 0x7fc4f54f2370 "\001", len = 0}, port_no = 56096, proto = 62801, type =
32708, flags = 9220640, transport = {
            s = 0x0, len = -213182428}, ttl = {s = 0x3e <Address 0x3e out of
bounds>, len = 0}, user_param = {s = 0x0, len = -1948873616}, maddr = {s =
0x7fff00000013 <Address 0x7fff00000013 out of bounds>, len = -179185072}, method =
{s = 0x3 <Address 0x3 out of bounds>, 
            len = -179351256}, lr = {s = 0x18bd69610 <Address 0x18bd69610 out of
bounds>, len = -179351408}, r2 = {s = 0x7fff8bd69908 "\020", len =
-178823952}, transport_val = {s = 0x7fc4f54f5128 "\002", len = 0}, ttl_val = {s
= 0x0, len = -180184096}, user_param_val = {
            s = 0x7fff8bd69610 "@", len = -2140416768}, maddr_val = {s =
0x7fff000013c4 <Address 0x7fff000013c4 out of bounds>, len = -179320760}, method_val
= {s = 0x0, len = -2140416768}, lr_val = {s = 0x7fc4f5575cf0 "N+\001", len =
-179178368}, r2_val = {
            s = 0x7fc4f5575cf0 "N+\001", len = -1948871616}}
        next_hop = {user = {s = 0x7fff8bd69440 "\002", len = -251703395}, passwd
= {s = 0x7fff8bd69440 "\002", len = -1948873400}, host = {s = 0xc8 <Address
0xc8 out of bounds>, len = 0}, port = {s = 0xdc786b5ee3ff4f9d <Address
0xdc786b5ee3ff4f9d out of bounds>, 
            len = 1037389725}, params = {s = 0x7fff00000000 <Address 0x7fff00000000 out
of bounds>, len = -179278216}, sip_params = {s = 0x7fc4f5575cf0 "N+\001", len
= -1948870864}, headers = {s = 0x7fff8bd68c2c "\001", len = 4961548}, port_no =
0, proto = 0, type = 32708, 
          flags = 4116143344, transport = {s = 0x7fff8bd69610 "@", len =
4957545}, ttl = {s = 0x0, len = 0}, user_param = {s = 0x48bd68c40 <Address 0x48bd68c40
out of bounds>, len = 0}, maddr = {s = 0x0, len = 0}, method = {s = 0x0, len =
-1948873616}, lr = {
            s = 0x7fff8bd68c70 "", len = -1948873400}, r2 = {s = 0x7fff8bd69440
"\002", len = 4943789}, transport_val = {s = 0x7fff8bd69610 "@", len =
-179362360}, ttl_val = {s = 0x38 <Address 0x38 out of bounds>, len = -1948872600},
user_param_val = {s = 0x7fff8bd69610 "@", 
            len = 4943789}, maddr_val = {s = 0x0, len = -179239392}, method_val = {s =
0x7fff8bd68c00 "\003", len = -178901504}, lr_val = {s = 0x8 <Address 0x8 out
of bounds>, len = -182674899}, r2_val = {s = 0x7fc4f5562e00 "\b", len =
5455931}}
        u = <value optimized out>
        port = <value optimized out>
        i = <value optimized out>
        flags = <value optimized out>
        avp = <value optimized out>
        st = {flags = 2346094984, id = 32767, name = {n = 200, s = {s = 0xc8 <Address
0xc8 out of bounds>, len = 0}, re = 0xc8}, avp = 0x4bba52}
        sct = <value optimized out>
        sjt = <value optimized out>
        rve = <value optimized out>
        mct = <value optimized out>
        rv = <value optimized out>
        rv1 = <value optimized out>
        c1 = {cache_type = RV_CACHE_EMPTY, val_type = 32767, c = {avp_val = {n =
-1948873408, s = {s = 0x7fff8bd68d40 "\360\\W\365\304\177", len = -178823952},
re = 0x7fff8bd68d40}, pval = {rs = {s = 0x7fff8bd68d40 "\360\\W\365\304\177",
len = -178823952}, ri = -180180168, 
              flags = 32708}}, i2s =
"p\202O\365\304\177\000\000\020\226\326\213\377\177\000\000\000\000\000\000\000"}
        s = {s = 0x7fc4f5575cf0 "N+\001", len = -179369672}
        srevp = {0x7fc4f5575cf0, 0x7fc4f54f0c98}
        mod_f_params = {{type = NOSUBTYPE, u = {number = 0, string = 0x0, str = {s = 0x0,
len = 0}, data = 0x0, attr = 0x0, select = 0x0}}, {type = NOSUBTYPE, u = {number = 0,
string = 0x0, str = {s = 0x0, len = 0}, data = 0x0, attr = 0x0, select = 0x0}}, {type =
NOSUBTYPE, 
            u = {number = 0, string = 0x0, str = {s = 0x0, len = 0}, data = 0x0, attr =
0x0, select = 0x0}}, {type = NOSUBTYPE, u = {number = 0, string = 0x0, str = {s = 0x0, len
= 0}, data = 0x0, attr = 0x0, select = 0x0}}, {type = NOSUBTYPE, u = {number = 0, string =
0x0, 
              str = {s = 0x0, len = 0}, data = 0x0, attr = 0x0, select = 0x0}}, {type =
NOSUBTYPE, u = {number = 0, string = 0x0, str = {s = 0x0, len = 0}, data = 0x0, attr =
0x0, select = 0x0}}, {type = NOSUBTYPE, u = {number = 0, string = 0x0, str = {s = 0x0, len
= 0}, 
              data = 0x0, attr = 0x0, select = 0x0}}, {type = NOSUBTYPE, u = {number = 0,
string = 0x0, str = {s = 0x0, len = 0}, data = 0x0, attr = 0x0, select = 0x0}}}
        __FUNCTION__ = "do_action"
#10 0x000000000041e51b in run_actions (h=<value optimized out>, a=<value
optimized out>, msg=<value optimized out>) at action.c:1610
        t = 0x7fc4f551fc80
        ret = <value optimized out>
        mod = <value optimized out>
#11 0x0000000000417c67 in do_action (h=0x7fff8bd69440, a=0x7fc4f55201a0, msg=<value
optimized out>) at action.c:1111
        ret = 1
        v = 1
        dst = {send_sock = 0x7fc4f5575cf0, to = {s = {sa_family = 59269, sa_data =
"\\\000\000\000\000\000\200_\026\336\304\177\000"}, sin = {sin_family = 59269,
sin_port = 92, sin_addr = {s_addr = 0}, sin_zero = "\200_\026\336\304\177\000"},
sin6 = {sin6_family = 59269, 
              sin6_port = 92, sin6_flowinfo = 0, sin6_addr = {__in6_u = {__u6_addr8 =
"\200_\026\336\304\177\000\000\200_\026\336\304\177\000", __u6_addr16 = {24448,
56854, 32708, 0, 24448, 56854, 32708, 0}, __u6_addr32 = {3726008192, 32708, 3726008192,
32708}}}, 
              sin6_scope_id = 3726008384}}, id = 32708, proto = 10 '\n',
send_flags = {f = 13 '\r', blst_imask = 0 '\000'}}
        tmp = <value optimized out>
        new_uri = <value optimized out>
---Type <return> to continue, or q <return> to quit---
        end = <value optimized out>
        crt = <value optimized out>
        len = <value optimized out>
        user = <value optimized out>
        uri = {user = {s = 0x2e36002e <Address 0x2e36002e out of bounds>, len = 0},
passwd = {
            s = 0x8bb1c6
&quot;829692(a)sip.flowroute.com&gt;;tag=aa681f9fdf30149b00040f579a1d99c4.f58b\r\nCall-IDnCall-ID:
1af37378498a705067258a2938d9297b(a)127.0.0.1\r\nCSeq: 3821 REGISTER\r\nDate: Wed, 23 Nov
2011 20:18:51 GMT\r\nX-Path: <sip:70.167."..., len = -2140416768}, host = {
            s = 0x7fff8bd69020 "\360\\W\365\304\177", len = -180173496}, port =
{s = 0x7fc4f5575cf0 "N+\001", len = 1}, params = {s = 0x7fc4f5505138
"\001", len = 1}, sip_params = {s = 0x7fc4f5575cf0 "N+\001", len =
-267418830}, headers = {s = 0x7fc4de35ac78 "1*\001", 
            len = -295894958}, port_no = 25808, proto = 62799, type = 32708, flags =
2154550528, transport = {s = 0x7fc400000001 <Address 0x7fc400000001 out of bounds>,
len = -179283720}, ttl = {s = 0x7fc4f5505118 "\002", len = -179285536},
user_param = {
            s = 0x7fc4f5505118 "\002", len = 1}, maddr = {s = 0x7fc4f5575cf0
"N+\001", len = 4582263}, method = {s = 0x7fc4f5575cf0 "N+\001", len =
-1948870392}, lr = {s = 0x7fff8bd69610 "@", len = 5385857}, r2 = {s =
0x7fc4ddf6b200 "", len = 1}, transport_val = {
            s = 0x38 <Address 0x38 out of bounds>, len = -182674899}, ttl_val = {s =
0x7fc400000000 <Address 0x7fc400000000 out of bounds>, len = 5455931},
user_param_val = {s = 0x3 <Address 0x3 out of bounds>, len = -2140416768}, maddr_val
= {
            s = 0x7fff8bd69620 "\340\230O\365\304\177", len = -179976704},
method_val = {s = 0x0, len = 5}, lr_val = {s = 0x7fc4f5575cf0 "N+\001", len =
-1948870392}, r2_val = {s = 0x7fff8bd69730 "", len = 4318491}}
        next_hop = {user = {s = 0x6 <Address 0x6 out of bounds>, len = -1948871152},
passwd = {s = 0x0, len = 4319332}, host = {s = 0x0, len = -2140416768}, port = {s =
0x7fff8bd69610 "@", len = -180175320}, params = {s = 0x7fc4f5575cf0
"N+\001", len = -1948871152}, 
          sip_params = {s = 0x7fff8bd690b8 "\001", len = -1948870392}, headers =
{s = 0x0, len = 4961745}, port_no = 0, proto = 0, type = 32767, flags = 4118665680,
transport = {s = 0x40e3da "__longjmp_chk", len = -571832496}, ttl = {s = 0x1
<Address 0x1 out of bounds>, 
            len = -178823952}, user_param = {s = 0x7fff8bd68fc0
"\364L\326\363\304\177", len = -1948872448}, maddr = {s = 0x8cb220
"\020\320<\365\304\177", len = -295897758}, method = {s = 0x100 <Address
0x100 out of bounds>, len = -206531498}, lr = {
            s = 0x13 <Address 0x13 out of bounds>, len = -295848817}, r2 = {s = 0x0,
len = -166137560}, transport_val = {s = 0x1a <Address 0x1a out of bounds>, len =
4715006}, ttl_val = {s = 0x1df <Address 0x1df out of bounds>, len = -1948871432},
user_param_val = {
            s = 0x7fff8bd69610 "@", len = 4943789}, maddr_val = {s =
0x7fff8bd69068 "\340QP\365\373\377\377\377\030QP\365\304\177", len = 0},
method_val = {s = 0x1df <Address 0x1df out of bounds>, len = -206660351}, lr_val =
{s = 0x1cc <Address 0x1cc out of bounds>, 
            len = -178823952}, r2_val = {s = 0x7fc4f3d64cf4 "N+\001", len =
-178823952}}
        u = <value optimized out>
        port = <value optimized out>
        i = <value optimized out>
        flags = <value optimized out>
        avp = <value optimized out>
        st = {flags = 355, id = 0, name = {n = -2140416768, s = {s = 0x249916eb806bd500
<Address 0x249916eb806bd500 out of bounds>, len = 48}, re = 0x249916eb806bd500}, avp
= 0x7fff8bd69730}
        sct = <value optimized out>
        sjt = <value optimized out>
        rve = 0x7fc4f551f480
        mct = <value optimized out>
        rv = <value optimized out>
        rv1 = <value optimized out>
        c1 = {cache_type = 4116143344, val_type = 32708, c = {avp_val = {n = -180563952, s
= {s = 0x7fc4f53cd010 "", len = -178827928}, re = 0x7fc4f53cd010}, pval = {rs =
{s = 0x7fc4f53cd010 "", len = -178827928}, ri = -182674899, flags = 32708}}, 
          i2s =
"\020\320<\365\304\177\000\000\235DS\000\000\000\000\000\a\000\000\000\000"}
        s = {s = 0x7fc4f5575cf0 "N+\001", len = -179369672}
        srevp = {0x7fc4f5575cf0, 0x7fc4f545b630}
        mod_f_params = {{type = NOSUBTYPE, u = {number = 0, string = 0x0, str = {s = 0x0,
len = 0}, data = 0x0, attr = 0x0, select = 0x0}}, {type = NOSUBTYPE, u = {number = 0,
string = 0x0, str = {s = 0x0, len = 0}, data = 0x0, attr = 0x0, select = 0x0}}, {type =
NOSUBTYPE, 
            u = {number = 0, string = 0x0, str = {s = 0x0, len = 0}, data = 0x0, attr =
0x0, select = 0x0}}, {type = NOSUBTYPE, u = {number = 0, string = 0x0, str = {s = 0x0, len
= 0}, data = 0x0, attr = 0x0, select = 0x0}}, {type = NOSUBTYPE, u = {number = 0, string =
0x0, 
              str = {s = 0x0, len = 0}, data = 0x0, attr = 0x0, select = 0x0}}, {type =
NOSUBTYPE, u = {number = 0, string = 0x0, str = {s = 0x0, len = 0}, data = 0x0, attr =
0x0, select = 0x0}}, {type = NOSUBTYPE, u = {number = 0, string = 0x0, str = {s = 0x0, len
= 0}, 
              data = 0x0, attr = 0x0, select = 0x0}}, {type = NOSUBTYPE, u = {number = 0,
string = 0x0, str = {s = 0x0, len = 0}, data = 0x0, attr = 0x0, select = 0x0}}}
        __FUNCTION__ = "do_action"
#12 0x000000000041e51b in run_actions (h=<value optimized out>, a=<value
optimized out>, msg=<value optimized out>) at action.c:1610
        t = 0x7fc4f55201a0
        ret = <value optimized out>
        mod = <value optimized out>
#13 0x000000000041e7f2 in run_top_route (a=0x7fc4f55201a0, msg=0x7fc4f5575cf0, c=<value
optimized out>) at action.c:1683
        ctx = {rec_lev = -1948871328, run_flags = 32767, last_retcode = -575003368,
jmp_env = {{__jmpbuf = {0, 2637164257529812224, 140479790317568, 140735539484056, 9155147,
9154819, 140483518377080, 140483906460912}, __mask_was_saved = -204059404, __saved_mask =
{__val = {
                  140735539484056, 140735539484944, 140483881142752, 28, 140483878773452,
140483513776312, 4607931593536, 3, 140735539484060, 9220624, 140483878784499, 9220352,
9220384, 1524722610456, 140483906460912, 140483906460912}}}}}
        p = 0x7fff8bd69440
        ret = <value optimized out>
        sfbk = 0
#14 0x00007fc4f3b31659 in reply_received (p_msg=0x7fc4f5575cf0) at t_reply.c:2195
        msg_status = 200
        last_uac_status = 408
        ack = <value optimized out>
        ack_len = 32708
        branch = 0
        reply_status = <value optimized out>
        onreply_route = 42128464
        cancel_data = {cancel_bitmap = 0, reason = {cause = 0, u = {text = {s = 0x0, len =
-2140416768}, e2e_cancel = 0x0, packed_hdrs = {s = 0x0, len = -2140416768}}}}
        t = 0x7fc4de183ae8
        lack_dst = {send_sock = 0x8, to = {s = {sa_family = 38704, sa_data =
"\326\213\377\177\000\000\360\\W\365\304\177\000"}, sin = {sin_family = 38704,
sin_port = 35798, sin_addr = {s_addr = 32767}, sin_zero =
"\360\\W\365\304\177\000"}, sin6 = {sin6_family = 38704, 
              sin6_port = 35798, sin6_flowinfo = 32767, sin6_addr = {__in6_u = {__u6_addr8
= "\360\\W\365\304\177\000\000\200LP\365\304\177\000", __u6_addr16 = {23792,
62807, 32708, 0, 19584, 62800, 32708, 0}, __u6_addr32 = {4116143344, 32708, 4115680384,
32708}}}, 
              sin6_scope_id = 4116135568}}, id = 32708, proto = 48 '0', send_flags
= {f = 151 '\227', blst_imask = 214 '\326'}}
        backup_user_from = 0x8cb110
        backup_user_to = 0x8cb118
        backup_domain_from = 0x8cb120
        backup_domain_to = 0x8cb128
        backup_uri_from = 0x8cb100
        backup_uri_to = 0x8cb108
        backup_xavps = 0x8cb210
        replies_locked = <value optimized out>
        branch_ret = <value optimized out>
        blst_503_timeout = <value optimized out>
        hf = <value optimized out>
        onsend_params = {req = 0x6, rpl = 0x55a4c0, param = 0x1d, code = 0, flags = 0,
branch = 0, t_rbuf = 0x0, dst = 0x5509cd, send_buf = {
            s = 0x7fc4ddef78b8 "ACK sip:19712418084@70.xxx.xxx.xxx SIP/2.0\r\nVia:
SIP/2.0/UDP 70.xxx.xxx.xxx;branch=z9hG4bK45e6.bb4840fb10d2fb79f355c8818d033652.0\r\nFrom:
\"5034374983\"
<sip:5034374983@50.16.209.171>;tag=as6d1fa03b\r\nTo:"..., len = -178831776}}
        ctx = {rec_lev = 2, run_flags = 0, last_retcode = 1, jmp_env = {{__jmpbuf =
{140735539483712, 2560152300345577373, 140483906109856, 140483906460912, 200,
140483516452208, -2560178333126013027, 2560151734698987421}, __mask_was_saved = 0,
__saved_mask = {__val = {5455931, 
                  48, 140483902609965, 140483905935336, 5455931, 440, 140483902609965,
140483905922992, 5455931, 8, 6150868, 5956312, 18446744052243869936, 140483906453136,
9155458, 9154773}}}}}
        __FUNCTION__ = "reply_received"
#15 0x0000000000452af5 in forward_reply (msg=0x7fc4f5575cf0) at forward.c:782
        new_buf = <value optimized out>
        dst = {send_sock = 0x0, to = {s = {sa_family = 0, sa_data = '\000'
<repeats 13 times>}, sin = {sin_family = 0, sin_port = 0, sin_addr = {s_addr = 0},
sin_zero = "\000\000\000\000\000\000\000"}, sin6 = {sin6_family = 0, sin6_port =
0, sin6_flowinfo = 0, sin6_addr = {
                __in6_u = {__u6_addr8 = '\000' <repeats 15 times>,
__u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, sin6_scope_id = 0}},
id = 0, proto = 0 '\000', send_flags = {f = 0 '\000', blst_imask = 0
'\000'}}
        new_len = <value optimized out>
        r = 0
        s = <value optimized out>
        len = <value optimized out>
        __FUNCTION__ = "forward_reply"
#16 0x0000000000498b5e in receive_msg (buf=0x8bb0c0 "SIP/2.0 200 OK\r\nVia:
SIP/2.0/UDP 70.xxx.xxx.xxx;branch=z9hG4bK880b.81b128becb98f2feed98b20cceba8b53.0\r\nVia:
SIP/2.0/UDP
192.168.1.8:5060;received=71.212.xxx.xxx;branch=z9hG4bK0fb2e054;rport=5060\r\nFrom"...,

    len=<value optimized out>, rcv_info=<value optimized out>) at
receive.c:267
---Type <return> to continue, or q <return> to quit---
        msg = 0x7fc4f5575cf0
        ctx = {rec_lev = 0, run_flags = 0, last_retcode = 1, jmp_env = {{__jmpbuf =
{140735539484464, 2560152300345577373, 140483905997952, 140483906460912, 140735539484936,
28, -2560178333006475363, 2560151734698987421}, __mask_was_saved = 0, __saved_mask =
{__val = {0, 
                  140735539484936, 28, 0, 140483916973969, 140479790317569, 0, 0,
140483908964984, 7, 140483906011736, 140483919099560, 140483906011744, 4294967245,
140483917001509, 140735539484966}}}}}
        ret = 0
        inb = {s = 0x8bb0c0 "SIP/2.0 200 OK\r\nVia: SIP/2.0/UDP
70.xxx.xxx.xxx;branch=z9hG4bK880b.81b128becb98f2feed98b20cceba8b53.0\r\nVia: SIP/2.0/UDP
192.168.1.8:5060;received=71.212.xxx.xxx;branch=z9hG4bK0fb2e054;rport=5060\r\nFrom"...,
len = 706}
        __FUNCTION__ = "receive_msg"
#17 0x00000000005253b7 in udp_rcv_loop () at udp_server.c:544
        len = 706
        buf = "SIP/2.0 200 OK\r\nVia: SIP/2.0/UDP
70.xxx.xxx.xxx;branch=z9hG4bK880b.81b128becb98f2feed98b20cceba8b53.0\r\nVia: SIP/2.0/UDP
192.168.1.8:5060;received=71.212.xxx.xxx;branch=z9hG4bK0fb2e054;rport=5060\r\nFrom"...
        from = 0x7fc4f5508258
        fromlen = 16
        ri = {src_ip = {af = 2, len = 4, u = {addrl = {2202366936, 140483513175212},
addr32 = {2202366936, 0, 3722857644, 32708}, addr16 = {29656, 33605, 0, 0, 19628, 56806,
32708, 0}, addr = "\330sE\203\000\000\000\000\254L\346\335\304\177\000"}},
dst_ip = {af = 2, len = 4, 
            u = {addrl = {2191107910, 0}, addr32 = {2191107910, 0, 0, 0}, addr16 = {42822,
33433, 0, 0, 0, 0, 0, 0}, addr = "F\247\231\202", '\000' <repeats 11
times>}}, src_port = 5060, dst_port = 5060, proto_reserved1 = 0, proto_reserved2 = 0,
src_su = {s = {sa_family = 2, 
              sa_data = "\023\304\330sE\203\000\000\000\000\000\000\000"}, sin =
{sin_family = 2, sin_port = 50195, sin_addr = {s_addr = 2202366936}, sin_zero =
"\000\000\000\000\000\000\000"}, sin6 = {sin6_family = 2, sin6_port = 50195,
sin6_flowinfo = 2202366936, sin6_addr = {
                __in6_u = {__u6_addr8 = '\000' <repeats 15 times>,
__u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, sin6_scope_id = 0}},
bind_address = 0x7fc4f5409fd0, proto = 1 '\001'}
        __FUNCTION__ = "udp_rcv_loop"
#18 0x0000000000463564 in main_loop () at main.c:1585
        i = 6
        pid = <value optimized out>
        si = 0x7fc4f5409fd0
        si_desc = "udp receiver child=6
sock=70.xxx.xxx.xxx:5060\000\000\000\000\000@\020", '\000' <repeats 12
times>,
"\016\b\000\000\000\000\000\000\000\325k\200\353\026\231$&\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\300\v\215\000\000\000\000\000\"\000\000\000\000\000\000\000\000\000@\020",
'\000' <repeats 11 times>
#19 0x0000000000465dd2 in main (argc=11, argv=0x7fff8bd69c08) at main.c:2475
        cfg_stream = <value optimized out>
        c = <value optimized out>
        r = <value optimized out>
        tmp = 0x7fff8bd6ae83 ""
        tmp_len = 0
        port = <value optimized out>
        proto = <value optimized out>
        ret = <value optimized out>
        seed = 350658550
        rfd = <value optimized out>
        debug_save = 272629760
        debug_flag = 34
        dont_fork_cnt = 0
        n_lst = 0x10400000
        p = <value optimized out>
(gdb) 

SIP Trace:

U 2011/11/23 20:18:49.724877 70.xxx.xxx.xxx:5060 -> 216.xxx.xxx.131:5060
REGISTER sip:sip.flowroute.com SIP/2.0.
Via: SIP/2.0/UDP 70.xxx.xxx.xxx;branch=z9hG4bK880b.81b128becb98f2feed98b20cceba8b53.0.
Via: SIP/2.0/UDP
192.168.1.8:5060;received=71.212.xxx.xxx;branch=z9hG4bK0fb2e054;rport=5060.
From: <sip:95000000@sip.flowroute.com>;tag=as3618eaa4.
To: <sip:95000000@sip.flowroute.com>.
Call-ID: 1af37378498a705067258a2938d9297b(a)127.0.0.1.
CSeq: 3821 REGISTER.
User-Agent: Asterisk PBX.
Max-Forwards: 69.
Authorization: Digest username="95000000", realm="sip.flowroute.com",
algorithm=MD5, uri="sip:sip.flowroute.com",
nonce="Ts1WVE7NVShd6X8POR4ePHfU2dEeHNYd",
response="6d6a3ec92e04b8b5b7aad470556cd9e5", qop=auth,
cnonce="4f518adb", nc=00000001.
Expires: 120.
Contact: <sip:s@192.168.1.8>.
Event: registration.
Content-Length: 0.
X-NAT: Yes.
Path: <sip:70.xxx.xxx.xxx;lr;received="sip:71.212.xxx.xxx:5060">.
..

U 2011/11/23 20:18:50.145804 70.xxx.xxx.xxx:5060 -> 216.xxx.xxx.131:5060
REGISTER sip:sip.flowroute.com SIP/2.0.
Via: SIP/2.0/UDP 70.xxx.xxx.xxx;branch=z9hG4bK880b.81b128becb98f2feed98b20cceba8b53.0.
Via: SIP/2.0/UDP
192.168.1.8:5060;received=71.212.xxx.xxx;branch=z9hG4bK0fb2e054;rport=5060.
From: <sip:95000000@sip.flowroute.com>;tag=as3618eaa4.
To: <sip:95000000@sip.flowroute.com>.
Call-ID: 1af37378498a705067258a2938d9297b(a)127.0.0.1.
CSeq: 3821 REGISTER.
User-Agent: Asterisk PBX.
Max-Forwards: 69.
Authorization: Digest username="95000000", realm="sip.flowroute.com",
algorithm=MD5, uri="sip:sip.flowroute.com",
nonce="Ts1WVE7NVShd6X8POR4ePHfU2dEeHNYd",
response="6d6a3ec92e04b8b5b7aad470556cd9e5", qop=auth,
cnonce="4f518adb", nc=00000001.
Expires: 120.
Contact: <sip:s@192.168.1.8>.
Event: registration.
Content-Length: 0.
X-NAT: Yes.
Path: <sip:70.xxx.xxx.xxx;lr;received="sip:71.212.xxx.xxx:5060">.
..

U 2011/11/23 20:18:50.958320 70.xxx.xxx.xxx:5060 -> 216.xxx.xxx.131:5060
REGISTER sip:sip.flowroute.com SIP/2.0.
Via: SIP/2.0/UDP 70.xxx.xxx.xxx;branch=z9hG4bK880b.81b128becb98f2feed98b20cceba8b53.0.
Via: SIP/2.0/UDP
192.168.1.8:5060;received=71.212.xxx.xxx;branch=z9hG4bK0fb2e054;rport=5060.
From: <sip:95000000@sip.flowroute.com>;tag=as3618eaa4.
To: <sip:95000000@sip.flowroute.com>.
Call-ID: 1af37378498a705067258a2938d9297b(a)127.0.0.1.
CSeq: 3821 REGISTER.
User-Agent: Asterisk PBX.
Max-Forwards: 69.
Authorization: Digest username="95000000", realm="sip.flowroute.com",
algorithm=MD5, uri="sip:sip.flowroute.com",
nonce="Ts1WVE7NVShd6X8POR4ePHfU2dEeHNYd",
response="6d6a3ec92e04b8b5b7aad470556cd9e5", qop=auth,
cnonce="4f518adb", nc=00000001.
Expires: 120.
Contact: <sip:s@192.168.1.8>.
Event: registration.
Content-Length: 0.
X-NAT: Yes.
Path: <sip:70.xxx.xxx.xxx;lr;received="sip:71.212.xxx.xxx:5060">.
..

U 2011/11/23 20:18:51.208640 70.xxx.xxx.xxx:5060 -> 70.yyy.yyy.136:5060
REGISTER sip:sip.flowroute.com SIP/2.0.
Via: SIP/2.0/UDP 70.xxx.xxx.xxx;branch=z9hG4bK880b.81b128becb98f2feed98b20cceba8b53.1.
Via: SIP/2.0/UDP
192.168.1.8:5060;received=71.212.xxx.xxx;branch=z9hG4bK0fb2e054;rport=5060.
From: <sip:95000000@sip.flowroute.com>;tag=as3618eaa4.
To: <sip:95000000@sip.flowroute.com>.
Call-ID: 1af37378498a705067258a2938d9297b(a)127.0.0.1.
CSeq: 3821 REGISTER.
User-Agent: Asterisk PBX.
Max-Forwards: 69.
Authorization: Digest username="95000000", realm="sip.flowroute.com",
algorithm=MD5, uri="sip:sip.flowroute.com",
nonce="Ts1WVE7NVShd6X8POR4ePHfU2dEeHNYd",
response="6d6a3ec92e04b8b5b7aad470556cd9e5", qop=auth,
cnonce="4f518adb", nc=00000001.
Expires: 120.
Contact: <sip:s@192.168.1.8>.
Event: registration.
Content-Length: 0.
X-NAT: Yes.
Path: <sip:70.xxx.xxx.xxx;lr;received="sip:71.212.xxx.xxx:5060">.
..

U 2011/11/23 20:18:51.208921 70.yyy.yyy.136:5060 -> 70.xxx.xxx.xxx:5060
SIP/2.0 401 Unauthorized.
Via: SIP/2.0/UDP 70.xxx.xxx.xxx;branch=z9hG4bK880b.81b128becb98f2feed98b20cceba8b53.1.
Via: SIP/2.0/UDP
192.168.1.8:5060;received=71.212.xxx.xxx;branch=z9hG4bK0fb2e054;rport=5060.
From: <sip:95000000@sip.flowroute.com>;tag=as3618eaa4.
To: <sip:95000000@sip.flowroute.com>;tag=509e4b53d8f55329251bd32637e73933.6d9a.
Call-ID: 1af37378498a705067258a2938d9297b(a)127.0.0.1.
CSeq: 3821 REGISTER.
WWW-Authenticate: Digest realm="sip.flowroute.com",
nonce="Ts1WVk7NVSryXrqyVJasJcNSVC+Q80c1", qop="auth".
Content-Length: 0.
..

U 2011/11/23 20:18:51.859222 216.xxx.xxx.131:5060 -> 70.xxx.xxx.xxx:5060
SIP/2.0 200 OK.
Via: SIP/2.0/UDP 70.xxx.xxx.xxx;branch=z9hG4bK880b.81b128becb98f2feed98b20cceba8b53.0.
Via: SIP/2.0/UDP
192.168.1.8:5060;received=71.212.xxx.xxx;branch=z9hG4bK0fb2e054;rport=5060.
From: <sip:95000000@sip.flowroute.com>;tag=as3618eaa4.
To: <sip:95000000@sip.flowroute.com>;tag=aa681f9fdf30149b00040f579a1d99c4.f58b.
Call-ID: 1af37378498a705067258a2938d9297b(a)127.0.0.1.
CSeq: 3821 REGISTER.
Date: Wed, 23 Nov 2011 20:18:51 GMT.
X-Path: <sip:70.xxx.xxx.xxx;lr;received="sip:71.212.xxx.xxx:5060">.
X-Auth-User: 95000000.
Contact:
<sip:s@192.168.1.8>;q=1;expires=13;received="sip:71.212.xxx.xxx:5060",
<sip:s@192.168.1.8>;q=1;expires=120;received="sip:71.212.xxx.xxx:5060".
Content-Length: 0.
..

U 2011/11/23 20:18:51.878876 216.xxx.xxx.131:5060 -> 70.xxx.xxx.xxx:5060
SIP/2.0 200 OK.
Via: SIP/2.0/UDP 70.xxx.xxx.xxx;branch=z9hG4bK880b.81b128becb98f2feed98b20cceba8b53.0.
Via: SIP/2.0/UDP
192.168.1.8:5060;received=71.212.xxx.xxx;branch=z9hG4bK0fb2e054;rport=5060.
From: <sip:95000000@sip.flowroute.com>;tag=as3618eaa4.
To: <sip:95000000@sip.flowroute.com>;tag=aa681f9fdf30149b00040f579a1d99c4.f58b.
Call-ID: 1af37378498a705067258a2938d9297b(a)127.0.0.1.
CSeq: 3821 REGISTER.
Date: Wed, 23 Nov 2011 20:18:51 GMT.
X-Path: <sip:70.xxx.xxx.xxx;lr;received="sip:71.212.xxx.xxx:5060">.
X-Auth-User: 95000000.
Contact:
<sip:s@192.168.1.8>;q=1;expires=13;received="sip:71.212.xxx.xxx:5060",
<sip:s@192.168.1.8>;q=1;expires=120;received="sip:71.212.xxx.xxx:5060".
Content-Length: 0.
..

U 2011/11/23 20:18:51.916798 216.xxx.xxx.131:5060 -> 70.xxx.xxx.xxx:5060
SIP/2.0 200 OK.
Via: SIP/2.0/UDP 70.xxx.xxx.xxx;branch=z9hG4bK880b.81b128becb98f2feed98b20cceba8b53.0.
Via: SIP/2.0/UDP
192.168.1.8:5060;received=71.212.xxx.xxx;branch=z9hG4bK0fb2e054;rport=5060.
From: <sip:95000000@sip.flowroute.com>;tag=as3618eaa4.
To: <sip:95000000@sip.flowroute.com>;tag=aa681f9fdf30149b00040f579a1d99c4.f58b.
Call-ID: 1af37378498a705067258a2938d9297b(a)127.0.0.1.
CSeq: 3821 REGISTER.
Date: Wed, 23 Nov 2011 20:18:51 GMT.
X-Path: <sip:70.xxx.xxx.xxx;lr;received="sip:71.212.xxx.xxx:5060">.
X-Auth-User: 95000000.
Contact:
<sip:s@192.168.1.8>;q=1;expires=13;received="sip:71.212.xxx.xxx:5060",
<sip:s@192.168.1.8>;q=1;expires=120;received="sip:71.212.xxx.xxx:5060".
Content-Length: 0.
..

More information can be found at the following URL:
http://sip-router.org/tracker/index.php?do=details&task_id=180

You are receiving this message because you have requested it from the Flyspray bugtracking
system.  If you did not expect this message or don't want to receive mails in future,
you can change your notification settings at the URL shown above.

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

[sr-dev] [tracker] Task opened: DOUBLE FREE / CRASH in parse_to.c