21 Mar
2019
21 Mar
'19
9:39 a.m.
### Description
`dialog` module is configured with `db_mode` 1 (realtime). When receiving following broken
SIP `200` response (missing 6 bytes between header and body), Kamailio crashes:
```
SIP/2.0 200 OK
Via: SIP/2.0/UDP 1.2.3.4;branch=z9hG4bKa185.ad1e5804a90a4f79fa2b09b3b2118053.0
Via: SIP/2.0/UDP 2.3.4.5:7016;received=2.3.4.5;branch=z9hG4bK370933d4;rport=7016
Record-Route: <sip:1.2.3.4;lr=on;did=c41.dee>
From: "1234" <sip:1234@example.com>;tag=as4cbf81fd
To: <sip:2345@example.com>;tag=3450065082
Call-ID: 727ca44f1e962eb321143475380dfbd9(a)example.com
CSeq: 102 INVITE
Contact: <sip:2345@3.4.5.6:12500>
Content-Type: application/sdp
Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER,
PUBLISH, UPDATE, MESSAGE
Content-Length: 2170
o=- 20568 20568 IN IP4 3.4.5.6
s=SDP data
c=IN IP4 3.4.5.6
t=0 0
m=audio 13002 RTP/AVP 8 101
a=rtpmap:8 PCMA/8000
a=ptime:20
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=sendrecv
```
Crash happens in
[dlg_db_handler.c](https://github.com/kamailio/kamailio/blob/master/src/modu…
```
LM_DBG("sock_info is %.*s\n",
cell->bind_addr[DLG_CALLER_LEG]->sock_str.len,
cell->bind_addr[DLG_CALLEE_LEG]->sock_str.s);
SET_STR_VALUE(values+7, cell->bind_addr[DLG_CALLER_LEG]->sock_str);
SET_STR_VALUE(values+8, cell->bind_addr[DLG_CALLEE_LEG]->sock_str);
```
#### Debugging Data
```
Thread 1 (Thread 0x7fc64b620700 (LWP 2333)):
+bt
#0 0x00007fc641675b63 in update_dialog_dbinfo_unsafe (cell=0x7fc619a71ff8) at
dlg_db_handler.c:784
#1 0x00007fc641676852 in update_dialog_dbinfo (cell=0x7fc619a71ff8) at
dlg_db_handler.c:881
#2 0x00007fc64167c861 in dlg_onreply (t=0x7fc61d7888f0, type=1048576,
param=0x7ffe1ce712f0) at dlg_handlers.c:509
#3 0x00007fc6443f4f17 in run_trans_callbacks_internal (cb_lst=0x7fc61d788960,
type=1048576, trans=0x7fc61d7888f0, params=0x7ffe1ce712f0) at t_hooks.c:260
#4 0x00007fc6443f5144 in run_trans_callbacks_with_buf (type=1048576, rbuf=0x7fc61d7889b0,
req=0x7fc61ec43928, repl=0x7fc646dcbd80, flags=0) at t_hooks.c:305
#5 0x00007fc6443aaabc in relay_reply (t=0x7fc61d7888f0, p_msg=0x7fc646dcbd80, branch=0,
msg_status=200, cancel_data=0x7ffe1ce71580, do_put_on_wait=1) at t_reply.c:1950
#6 0x00007fc6443ae844 in reply_received (p_msg=0x7fc646dcbd80) at t_reply.c:2521
#7 0x000055fd54405df6 in do_forward_reply (msg=0x7fc646dcbd80, mode=0) at
core/forward.c:749
#8 0x000055fd5440784b in forward_reply (msg=0x7fc646dcbd80) at core/forward.c:851
#9 0x000055fd544522d2 in receive_msg (buf=0x55fd5492d080 <buf> "SIP/2.0 200
OK\r\nVia: SIP/2.0/UDP ...", len=960, rcv_info=0x7ffe1ce71ad0) at core/receive.c:341
#10 0x000055fd5436e207 in udp_rcv_loop () at core/udp_server.c:515
#11 0x000055fd542dc608 in main_loop () at main.c:1623
#12 0x000055fd542e46a9 in main (argc=13, argv=0x7ffe1ce71f78) at main.c:2642
```
### Possible Solutions
Check `bind_addr` before accessing.
### Additional Information
Version was 5.0.x, but at least code in `dlg_handler.c` wasn't modified in `master`
since then.
--
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/1899