[sr-dev] [kamailio] kamailio segfault when doing t_precheck_trans() from tmx.so if Cseq header missed or invalid (#331)

18 Sep 2015

#### kamailio segfault when doing t_precheck_trans() from tmx.so  if Cseq header missed or
invalid

We received an invalid REGISTER request.

Normally, CSeq header is expected to be `Cseq: 2 REGISTER`, but client sent it as `a9: 2
REGISTER`

I don't know is this an attack or a buggy/experimental client.
But it can be reproduced/attacked easily.

Segfault occurs when doing `t_precheck_trans()` from `tmx.so`

#### test kamailio version:
```
kamailio 4.3.2 stable
kamailio 4.4.0-dev4 (id: 33f159 )
```

#### backtrace:

```
#0  0x00007fb4a2086496 in tmx_check_pretran (msg=0x7fb5e5920e40) at tmx_pretran.c:214
        chid = 0
        slotid = 5568065
        dsize = 0
        vbr = 0x55fbd3d6
        scallid = {s = 0x3 <Address 0x3 out of bounds>, len = 5252091}
        scseqmet = {s = 0xffffffffffffffa8 <Address 0xffffffffffffffa8 out of
bounds>, len = 42465376}
        scseqnum = {s = 0x7fb5e4e3f1c0 "\023", len = -443412928}
        sftag = {s = 0x3000000010 <Address 0x3000000010 out of bounds>, len =
358984288}
        svbranch = {s = 0x0, len = 0}
        it = 0x287f860
        __FUNCTION__ = "tmx_check_pretran"
#1  0x00007fb4a2084819 in w_t_precheck_trans (msg=0x7fb5e5920e40, p1=0x0, p2=0x0) at
tmx_mod.c:713
        ret = 4
#2  0x00000000004213a8 in do_action (h=0x7fff1565b230, a=0x7fb5e4e5bea0,
msg=0x7fb5e5920e40) at action.c:1053
        ret = -5
        v = 358985792
        dst = {send_sock = 0x0, to = {s = {sa_family = 3, sa_data =
"\000\000\000\000\000\000\260\222A\000\000\000\000"}, sin = {sin_family = 3,
sin_port = 0, sin_addr = {s_addr = 0}, 
              sin_zero = "\260\222A\000\000\000\000"}, sin6 = {sin6_family = 3,
sin6_port = 0, sin6_flowinfo = 0, sin6_addr = {__in6_u = {
                  __u6_addr8 =
"\260\222A\000\000\000\000\000\200\312e\025\377\177\000", __u6_addr16 = {37552,
65, 0, 0, 51840, 5477, 32767, 0}, __u6_addr32 = {4297392, 0, 358992512, 32767}}}, 
              sin6_scope_id = 0}}, id = 0, proto = 0 '\000', send_flags = {f = 0
'\000', blst_imask = 0 '\000'}}
        tmp = 0x7fb4a0d24998 "new_dlg_var"
        new_uri = 0xaae450 ""
        end = 0x7fff1565b0bc "\001"
        crt = 0x740062c98c <Address 0x740062c98c out of bounds>
        cmd = 0x7fb5e4e00280
        len = 0
        user = 5244875
        uri = {user = {s = 0x36303333 <Address 0x36303333 out of bounds>, len = 5},
passwd = {s = 0x1ffffffff <Address 0x1ffffffff out of bounds>, len = -454825368},
host = {s = 0x7fb5e522a190 "", 
            len = -443412928}, port = {s = 0x400000000 <Address 0x400000000 out of
bounds>, len = 0}, params = {s = 0x7fff1565ae50 "\260\222A", len =
-443412928}, sip_params = {
            s = 0x7fb5e4e5b8e0 "\214\002", len = 358989184}, headers = {s =
0x7fb5e4e241f0 "2\002", len = 3}, port_no = 37552, proto = 65, type =
ERROR_URI_T, flags = 0, transport = {
            s = 0x100000000 <Address 0x100000000 out of bounds>, len = 0}, ttl = {s
= 0x7fff1565ae70 "", len = 3}, user_param = {s = 0x4192b0
"1\355I\211\321^H\211\342H\203\344\360PTI\307\300\200}p", 
            len = 358992512}, maddr = {s = 0x0, len = 0}, method = {s = 0x7fff1565b500
"\340\265e\025\377\177", len = 4330346}, lr = {s = 0x7fff1565af90
"\240\260e\025\377\177", len = 4382429}, r2 = {
            s = 0x0, len = -443412928}, gr = {s = 0x7fb5e4e241f0 "2\002", len =
358989184}, transport_val = {s = 0x0, len = -1}, ttl_val = {s = 0x3 <Address 0x3 out of
bounds>, len = 1533694924}, 
          user_param_val = {s = 0x4192b0
"1\355I\211\321^H\211\342H\203\344\360PTI\307\300\200}p", len = 358992512},
maddr_val = {s = 0x0, len = 0}, method_val = {
            s = 0xc33187ed5d0a53cc <Address 0xc33187ed5d0a53cc out of bounds>, len =
-1407167540}, lr_val = {s = 0x0, len = 42180172}, r2_val = {s = 0x2839e4c "8",
len = 42180172}, gr_val = {
            s = 0x2839e4d "", len = 0}}
        next_hop = {user = {s = 0x4192b0
"1\355I\211\321^H\211\342H\203\344\360PTI\307\300\200}p", len = 358992512},
passwd = {s = 0x0, len = 0}, host = {s = 0x7fff1565ac80 "\220\255e\025\377\177",

            len = -1594701152}, port = {s = 0x41565ad48 <Address 0x41565ad48 out of
bounds>, len = -1594672553}, params = {s = 0x1200000000 <Address 0x1200000000 out of
bounds>, len = 358986560}, 
          sip_params = {s = 0x7fff1565ad90 "p\256e\025\377\177", len = 3},
headers = {s = 0x3 <Address 0x3 out of bounds>, len = 4297392}, port_no = 51840,
proto = 5477, type = 32767, flags = 0, 
          transport = {s = 0x7fff1565ae70 "", len = 5586132}, ttl = {s =
0x7fb5e4e31da8 "\002", len = 0}, user_param = {s = 0x5a0f33e3f <Address
0x5a0f33e3f out of bounds>, len = 42364218}, maddr = {
            s = 0x0, len = 7893184}, method = {s = 0x30 <Address 0x30 out of
bounds>, len = -455233520}, lr = {s = 0x7fb5e523d618 " +\206\002", len =
-462842668}, r2 = {s = 0x7fb5e4ddb010 "\001", 
            len = -450635544}, gr = {s = 0x7fb5e4e4c200 "\031", len = 1},
transport_val = {s = 0x7fb5e4e3ea68 "\330\240\"\345\265\177", len =
-443412928}, ttl_val = {
            s = 0x7fb5e52217a0
"authuuid=<urn:uuid:9w12e22c6a-71123a-42423839-9adb-452aa48e849d>
chk_limit_user=658001739", len = 89}, user_param_val = {s = 0x0, len = 1}, maddr_val
= {
            s = 0x7fff1565aff0 "\003", len = 3}, method_val = {s = 0x4192b0
"1\355I\211\321^H\211\342H\203\344\360PTI\307\300\200}p", len = 358992512},
lr_val = {s = 0x0, len = 0}, r2_val = {
            s = 0x7fff1565ae70 "", len = 4380745}, gr_val = {s =
0xffffffff1565ae80 <Address 0xffffffff1565ae80 out of bounds>, len = 4380745}}
        u = 0x7fff1565b150
        port = 0
        dst_host = 0x4192b0
        i = 11199588
        flags = 0
        avp = 0x7fb5e4e32d58
        st = {flags = 0, id = 0, name = {n = -450750471, s = {s = 0x7fb5e52217f9
"", len = 0}, re = 0x7fb5e52217f9}, avp = 0x59e5922ab0}
        sct = 0xffffffff
        sjt = 0x54f361
        rve = 0xc33187ed588a53cc
        mct = 0x7fff1565b0a0
        rv = 0x59
        rv1 = 0x1ac2053cc
        c1 = {cache_type = 3851554368, val_type = 32693, c = {avp_val = {n = 358989184, s
= {s = 0x7fff1565bd80 "\001", len = 1}, re = 0x7fff1565bd80}, pval = {rs = {s =
0x7fff1565bd80 "\001", len = 1}, 
              ri = -443412928, flags = 32693}}, i2s =
"\274\231q\000\000\000\000\000\026:\363\240\264\177\000\000`\002\000\000\000"}
        s = {s = 0x7fb5e4e3f1b0 "\001", len = 358985252}
        srevp = {0x59, 0x7fb624eb4ec0}
        mod_f_params = {{type = NOSUBTYPE, u = {number = 0, string = 0x0, str = {s = 0x0,
len = 0}, data = 0x0, attr = 0x0, select = 0x0}}, {type = NOSUBTYPE, u = {number = 0,
string = 0x0, str = {
                s = 0x0, len = 0}, data = 0x0, attr = 0x0, select = 0x0}}, {type =
NOSUBTYPE, u = {number = 0, string = 0x0, str = {s = 0x0, len = 0}, data = 0x0, attr =
0x0, select = 0x0}}, {
            type = NOSUBTYPE, u = {number = 0, string = 0x0, str = {s = 0x0, len = 0},
data = 0x0, attr = 0x0, select = 0x0}}, {type = NOSUBTYPE, u = {number = 0, string = 0x0,
str = {s = 0x0, len = 0}, 
              data = 0x0, attr = 0x0, select = 0x0}}, {type = NOSUBTYPE, u = {number = 0,
string = 0x0, str = {s = 0x0, len = 0}, data = 0x0, attr = 0x0, select = 0x0}}, {type =
NOSUBTYPE, u = {
              number = 0, string = 0x0, str = {s = 0x0, len = 0}, data = 0x0, attr = 0x0,
select = 0x0}}, {type = NOSUBTYPE, u = {number = 0, string = 0x0, str = {s = 0x0, len =
0}, data = 0x0, 
              attr = 0x0, select = 0x0}}}
        __FUNCTION__ = "do_action"
#3  0x000000000042d849 in run_actions (h=0x7fff1565b230, a=0x7fb5e4e5bea0,
msg=0x7fb5e5920e40) at action.c:1548
        t = 0x7fb5e4e5bea0
        ret = -1
        mod = 0x7fff1565bd80
        ms = 0
        __FUNCTION__ = "run_actions"
#4  0x000000000042dedd in run_actions_safe (h=0x7fff1565bd80, a=0x7fb5e4e5bea0,
msg=0x7fb5e5920e40) at action.c:1613
        ctx = {rec_lev = 1, run_flags = 0, last_retcode = 0, jmp_env = {{__jmpbuf = {3,
-4381571508826647604, 4297392, 140733552380544, 0, 0, -4381571508799384628,
4381911880933856204}, 
              __mask_was_saved = 0, __saved_mask = {__val = {5471061, 140733552374672,
140413768858168, 3839733776, 140413811978464, 3, 140419217362496, 140419205825424,
140733552377216, 140733552374672, 
                  2698014181, 0, 3, 4297392, 140733552380544, 0}}}}}
        ret = 1
        ign_on_break = 0
#5  0x000000000054f361 in rval_get_int (h=0x7fff1565bd80, msg=0x7fb5e5920e40,
i=0x7fff1565bab0, rv=0x7fb5e4e5c698, cache=0x0) at rvalue.c:912
        r_avp = 0xe4e1ce58
        avp_val = {n = 358986880, s = {s = 0x7fff1565b480
"P\317\341\344\265\177", len = 0}, re = 0x7fff1565b480}
        pval = {rs = {s = 0x7fff1565b420 "\340\265e\025\377\177", len =
-1596939347}, ri = 4297392, flags = 0}
        tmp = {s = 0x0, len = 0}
        s = 0x0
        r = 1
        ret = 0
        destroy_pval = 0
        __FUNCTION__ = "rval_get_int"
#6  0x00000000005537b9 in rval_expr_eval_int (h=0x7fff1565bd80, msg=0x7fb5e5920e40,
res=0x7fff1565bab0, rve=0x7fb5e4e5c690) at rvalue.c:1910
        i1 = 1
        i2 = 0
        ret = -1
        c1 = {cache_type = 4297392, val_type = RV_NONE, c = {avp_val = {n = 358992512, s =
{s = 0x7fff1565ca80 "\r", len = 0}, re = 0x7fff1565ca80}, pval = {rs = {s =
0x7fff1565ca80 "\r", len = 0}, 
              ri = -443412928, flags = 32693}}, i2s =
"\020\331\343\344\265\177\000\000\200\275e\025\377\177\000\000@\016\222\345\265\177"}
        c2 = {cache_type = RV_CACHE_EMPTY, val_type = RV_NONE, c = {avp_val = {n =
618806060, s = {s = 0x7fb624e23b2c "\200\275\250\372\377\377", len =
-1583549560}, re = 0x7fb624e23b2c}, pval = {rs = {
                s = 0x7fb624e23b2c "\200\275\250\372\377\377", len =
-1583549560}, ri = 99, flags = 0}}, i2s =
"\377\377\377\377\001\000\000\000X\330\341\344\265\177\000\000ȭ\"\345\265\177"}
        rv1 = 0x42d849
        rv2 = 0x7fff1565b5e0
        __FUNCTION__ = "rval_expr_eval_int"
#7  0x0000000000420e99 in do_action (h=0x7fff1565bd80, a=0x7fb5e4e5c2b8,
msg=0x7fb5e5920e40) at action.c:1029
        ret = -5
        v = 1
        dst = {send_sock = 0x7fb49f2ec1e5, to = {s = {sa_family = 7816, sa_data =
"\222\345\265\177\000\000\350K!\345\265\177\000"}, sin = {sin_family = 7816,
sin_port = 58770, sin_addr = {
                s_addr = 32693}, sin_zero = "\350K!\345\265\177\000"}, sin6 =
{sin6_family = 7816, sin6_port = 58770, sin6_flowinfo = 32693, sin6_addr = {__in6_u = {
                  __u6_addr8 =
"\350K!\345\265\177\000\000\223\215\206\002\000\000\000", __u6_addr16 = {19432,
58657, 32693, 0, 36243, 646, 0, 0}, __u6_addr32 = {3844164584, 32693, 42372499, 0}}}, 
              sin6_scope_id = 42372565}}, id = 0, proto = -36 '\334', send_flags =
{f = 141 '\215', blst_imask = 134 '\206'}}
        tmp = 0x28690ac ""
        new_uri = 0x7fff1565bbb0 "\220\274e\025\377\177"
        end = 0x26 <Address 0x26 out of bounds>
        crt = 0x40000000 <Address 0x40000000 out of bounds>
        cmd = 0x7fb5e4e07f30
        len = 32693
        user = -455233520
        uri = {user = {s = 0x7fff1565b970 "йe\025\377\177", len = -455233520},
passwd = {s = 0x7fff1565b970 "йe\025\377\177", len = -1626440701}, host = {
            s = 0x1e00000030 <Address 0x1e00000030 out of bounds>, len = 0}, port =
{s = 0x40000000 <Address 0x40000000 out of bounds>, len = 1069135688}, params = {
            s = 0x6564313231663535 <Address 0x6564313231663535 out of bounds>, len =
6498930}, sip_params = {s = 0x7fff1565b990 "", len = -455233520}, headers = {s =
0x2 <Address 0x2 out of bounds>, 
            len = -455233520}, port_no = 47568, proto = 5477, type = 32767, flags =
3844164584, transport = {s = 0x28690ac "", len = 42372504}, ttl = {s =
0x40000000 <Address 0x40000000 out of bounds>, 
            len = 1061917912}, user_param = {s = 0x5055a98 <Address 0x5055a98 out of
bounds>, len = 11823912}, maddr = {s = 0xb47ab0 <Address 0xb47ab0 out of bounds>,
len = 8}, method = {
            s = 0x25 <Address 0x25 out of bounds>, len = 7891776}, lr = {s =
0x7fff1565ba00 "\340\272e\025\377\177", len = 4737794}, r2 = {s = 0x7fb5e5921d20
 <incomplete sequence \353>, len = 7845161}, 
          gr = {s = 0x1d00000000 <Address 0x1d00000000 out of bounds>, len = 0},
transport_val = {s = 0x7fff1565bae0 "\220\274e\025\377\177", len = 6481524},
ttl_val = {
            s = 0x8 <Address 0x8 out of bounds>, len = -455233520}, user_param_val =
{s = 0x7fff1565ba80 "\345\301.\237\264\177", len = -1626440701}, maddr_val = {s
= 0x7fb5e4ddb010 "\001", len = 0}, 
          method_val = {s = 0x40000000 <Address 0x40000000 out of bounds>, len =
358988432}, lr_val = {s = 0x7fb49f2ec1e5 "16b69a28-55fbd32b-121de-", len =
358988672}, r2_val = {
            s = 0x786b40 "get_hdr_field", len = 7879820}, gr_val = {s = 0xe8
<Address 0xe8 out of bounds>, len = -455233520}}
        next_hop = {user = {s = 0x22 <Address 0x22 out of bounds>, len = 7993972},
passwd = {s = 0x7fff1565b7c0 "\240\270e\025\377\177", len = 4737794}, host = {s
= 0x0, len = 7845161}, port = {
            s = 0x800000000 <Address 0x800000000 out of bounds>, len = 0}, params =
{s = 0x7fff1565b8a0 "\340\272e\025\377\177", len = 6481524}, sip_params = {
            s = 0x7fb4a083e6a5 "16b69a28-55fbd32b-121de-", len = -1601968475},
headers = {s = 0x4a083e6a5 <Address 0x4a083e6a5 out of bounds>, len = -1583549549},
port_no = 19432, proto = 58657, 
          type = 32693, flags = 3851558176, transport = {s = 0x7fff1565b9a2
"\005\005", len = 358988195}, ttl = {s = 0x28690ac "", len =
42372565}, user_param = {s = 0x79fa74 "parse_via", len = 7982755}, 
          maddr = {s = 0x40 <Address 0x40 out of bounds>, len = -455233520}, method
= {s = 0x7fb5e4ddb010 "\001", len = 0}, lr = {s = 0x7fb5e4ddb010
"\001", len = -455200168}, r2 = {
            s = 0x5007fb5e5921ce8 <Address 0x5007fb5e5921ce8 out of bounds>, len =
358988188}, gr = {s = 0x4004192b0 <Address 0x4004192b0 out of bounds>, len =
42372528}, transport_val = {
            s = 0x4004192b0 <Address 0x4004192b0 out of bounds>, len = 42372532},
ttl_val = {
            s = 0x2868db4 ";alias;branch=z9hG4bK-218503-1-2;rport\r\nFrom:
\"658001739\"<sip:658001739@38.106.57.68:5003>;tag=1\r\nTo:
\"658001739\"<sip:658001739@38.106.57.68:5003>\r\na9: 2
REGISTER\r\nCall-ID: 1-218503(a)211.78.19.2\r\nMax-F&quot;quot;..., len = 4}, user_param_val = {s
= 0x7fff1565bae0 "\220\274e\025\377\177", len = 6942257}, maddr_val = {s = 0x0,
len = 0}, method_val = {s = 0x7fb4a03f704c "\t", 
            len = -1604241065}, lr_val = {s = 0x0, len = 0}, r2_val = {s = 0x7fb4a30eb094
"\336!\001", len = 6498930}, gr_val = {s = 0x7fff1565b930 "", len =
-455233520}}
        u = 0x40
        port = 0
        dst_host = 0x7fff1565bc40
        i = 7879820
        flags = 0
        avp = 0x786b32
        st = {flags = 1073741824, id = 0, name = {n = 1061917720, s = {s = 0x3f4b9418
<Address 0x3f4b9418 out of bounds>, len = 11164504}, re = 0x3f4b9418}, avp =
0xb46be8}
        sct = 0x7fff1565bb20
        sjt = 0x648059
        rve = 0x7fb5e4e5c690
        mct = 0x7fff1565bc90
        rv = 0x0
        rv1 = 0x146e4ddb010
        c1 = {cache_type = 358987600, val_type = 32767, c = {avp_val = {n = -455233520, s
= {s = 0x7fb5e4ddb010 "\001", len = 358987648}, re = 0x7fb5e4ddb010}, pval = {rs
= {s = 0x7fb5e4ddb010 "\001", 
                len = 358987648}, ri = -455233520, flags = 32693}}, i2s =
"\220\267e\025\377\177\000\000\003|\016\237\264\177\000\000\000\000\000@\000"}
        s = {s = 0x7fff1565b740 "", len = 6498930}
        srevp = {0x7fff1565b7b0, 0x632a72}
        mod_f_params = {{type = NOSUBTYPE, u = {number = 0, string = 0x0, str = {s = 0x0,
len = 0}, data = 0x0, attr = 0x0, select = 0x0}}, {type = NOSUBTYPE, u = {number = 0,
string = 0x0, str = {
                s = 0x0, len = 0}, data = 0x0, attr = 0x0, select = 0x0}}, {type =
NOSUBTYPE, u = {number = 0, string = 0x0, str = {s = 0x0, len = 0}, data = 0x0, attr =
0x0, select = 0x0}}, {
            type = NOSUBTYPE, u = {number = 0, string = 0x0, str = {s = 0x0, len = 0},
data = 0x0, attr = 0x0, select = 0x0}}, {type = NOSUBTYPE, u = {number = 0, string = 0x0,
str = {s = 0x0, len = 0}, 
              data = 0x0, attr = 0x0, select = 0x0}}, {type = NOSUBTYPE, u = {number = 0,
string = 0x0, str = {s = 0x0, len = 0}, data = 0x0, attr = 0x0, select = 0x0}}, {type =
NOSUBTYPE, u = {
              number = 0, string = 0x0, str = {s = 0x0, len = 0}, data = 0x0, attr = 0x0,
select = 0x0}}, {type = NOSUBTYPE, u = {number = 0, string = 0x0, str = {s = 0x0, len =
0}, data = 0x0, 
              attr = 0x0, select = 0x0}}}
        __FUNCTION__ = "do_action"
#8  0x000000000042d849 in run_actions (h=0x7fff1565bd80, a=0x7fb5e4e1c550,
msg=0x7fb5e5920e40) at action.c:1548
        t = 0x7fb5e4e5c2b8
        ret = 1
        mod = 0x2868d8a
        ms = 0
        __FUNCTION__ = "run_actions"
#9  0x000000000042dfa5 in run_top_route (a=0x7fb5e4e1c550, msg=0x7fb5e5920e40, c=0x0) at
action.c:1634
        ctx = {rec_lev = 1, run_flags = 0, last_retcode = 1, jmp_env = {{__jmpbuf = {3,
-4381571508384148532, 4297392, 140733552380544, 0, 0, -4381571508340108340,
4381911880933856204}, 
              __mask_was_saved = 0, __saved_mask = {__val = {140413791782471,
4611686022726652592, 3851554368, 4611686022729891907, 0, 140733552377392, 140413791968530,
1, 0, 4611686023081347712, 
                  140419217362496, 140733552377456, 5691780, 4653956720, 140419217362496,
4611686022726652592}}}}}
        p = 0x7fff1565bd80
        ret = 0
        sfbk = 0
#10 0x0000000000514651 in receive_msg (
    buf=0x2868d70 "REGISTER sip:38.106.57.68 SIP/2.0\r\nVia: SIP/2.0/TCP
211.78.19.2:5060;alias;branch=z9hG4bK-218503-1-2;rport\r\nFrom:
\"658001739\"<sip:658001739@38.106.57.68:5003>;tag=1\r\nTo:
\"658001739\"<sip:658001739@38.1"..., len=828, rcv_info=0x7fb4a5ae6990)
at receive.c:196
        msg = 0x7fb5e5920e40
        ctx = {rec_lev = 358989904, run_flags = 32767, last_retcode = 0, jmp_env =
{{__jmpbuf = {4297392, 140733552380544, 0, 0, 140733552377744, 6290541, 5, 0},
__mask_was_saved = 1, __saved_mask = {
                __val = {140420280161997, 140733552378808, 140413850511736, 42372448,
140419660776252, 51539623935, 140413850511864, 42949673153, 140413850513313,
140733552380544, 140413850513316, 
                  140733552378016, 6291035, 65536, 4300871118, 65584}}}}}
        ret = 65536
        inb = {
          s = 0x2868d70 "REGISTER sip:38.106.57.68 SIP/2.0\r\nVia: SIP/2.0/TCP
211.78.19.2:5060;alias;branch=z9hG4bK-218503-1-2;rport\r\nFrom:
\"658001739\"<sip:658001739@38.106.57.68:5003>;tag=1\r\nTo:
\"658001739\"<sip:658001739@38.1"..., len = 828}
        __FUNCTION__ = "receive_msg"
#11 0x000000000060410a in receive_tcp_msg (
    tcpbuf=0x7fb4a5ae6c68 "REGISTER sip:38.106.57.68 SIP/2.0\r\nVia: SIP/2.0/TCP
211.78.19.2:5060;alias;branch=z9hG4bK-218503-1-2;rport\r\nFrom:
\"658001739\"<sip:658001739@38.106.57.68:5003>;tag=1\r\nTo:
\"658001739\"<sip:658001739@38.1"..., len=828, rcv_info=0x7fb4a5ae6990,
con=0x7fb4a5ae6978) at tcp_read.c:1247
        buf = 0x2868d70 "REGISTER sip:38.106.57.68 SIP/2.0\r\nVia: SIP/2.0/TCP
211.78.19.2:5060;alias;branch=z9hG4bK-218503-1-2;rport\r\nFrom:
\"658001739\"<sip:658001739@38.106.57.68:5003>;tag=1\r\nTo:
\"658001739\"<sip:658001739@38.1"...
        bsize = 65535
        blen = 65535
        __FUNCTION__ = "receive_tcp_msg"
#12 0x0000000000605969 in tcp_read_req (con=0x7fb4a5ae6978, bytes_read=0x7fff1565c3c0,
read_flags=0x7fff1565c3b8) at tcp_read.c:1401
        bytes = 828
        total_bytes = 828
        resp = 1
        size = 0
        req = 0x7fb4a5ae69f8
        dst = {send_sock = 0x7fff1565c3b0, to = {s = {sa_family = 8, sa_data =
'\000' <repeats 13 times>}, sin = {sin_family = 8, sin_port = 0, sin_addr =
{s_addr = 0}, 
              sin_zero = "\000\000\000\000\000\000\000"}, sin6 = {sin6_family =
8, sin6_port = 0, sin6_flowinfo = 0, sin6_addr = {__in6_u = {__u6_addr8 = '\000'
<repeats 15 times>, __u6_addr16 = {0, 0, 
                    0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, sin6_scope_id =
358990192}}, id = 32767, proto = 1 '\001', send_flags = {f = 0 '\000',
blst_imask = 0 '\000'}}
        c = 108 'l'
        ret = -1
        __FUNCTION__ = "tcp_read_req"
#13 0x0000000000608b6d in handle_io (fm=0x7fb5e523fca0, events=1, idx=-1) at
tcp_read.c:1624
        ret = 0
        n = -1
        read_flags = 1
        con = 0x7fb4a5ae6978
        s = 12
        resp = 1
        t = 2025289533
        __FUNCTION__ = "handle_io"
#14 0x00000000005fc0a7 in io_wait_loop_epoll (h=0xa526c0, t=2, repeat=1) at
io_wait.h:1061
        n = 1
        r = 0
        fm = 0x7fb5e523fca0
        revents = 1
        __FUNCTION__ = "io_wait_loop_epoll"
#15 0x0000000000609ca8 in tcp_receive_loop (unix_sock=78) at tcp_read.c:1739
        __FUNCTION__ = "tcp_receive_loop"
#16 0x00000000005f2735 in tcp_init_children () at tcp_main.c:4787
        r = 5
        i = 23
        reader_fd_1 = 78
        pid = 0
        si_desc = "tcp receiver
(generic)\000\000\000\000\000\000\000\000\000\000\240\306e\025\377\177\000\000\367\022Z\000\000\000\000\000\240\306e\025\377\177\000\000.\362B\000\000\000\000\000\200\300\337\344\265\177\000\000\060\323
\345\265\177\000\000\000\000\000\000\001\000\000\000\260\303\336$\266\177\000\000\327nr\000\000\000\000\000\360\025\341\344\265\177\000\000)\000\000\000*\000\000\000\260\222A\000\301!\001"
        si = 0x0
        __FUNCTION__ = "tcp_init_children"
#17 0x00000000004afcf8 in main_loop () at main.c:1664
        i = 24
        pid = 74177
        si = 0x0
        si_desc = "udp receiver child=23
sock=38.106.57.68:5003\000\177\000\000\200\307e\025\377\177\000\000Z\310b\000\000\000\000\000X\262u\000\000\000\000\000\000\017!f\000\000\000\000\260\222A\000\000\000\000\000\260\304\301\242\264\177\000\000\000\000\000\000\000\000\000\000\360\066!\345\265\177\000\000\320\307e\025\377\177\000\000w9c\000\000\000\000"
        nrprocs = 24
        __FUNCTION__ = "main_loop"
#18 0x00000000004b5904 in main (argc=13, argv=0x7fff1565ca88) at main.c:2566
        cfg_stream = 0x27bc010
        c = -1
        r = 0
        tmp = 0x7fff1565d7d0 ""
        tmp_len = 0
        port = 0
        proto = 32694
        options = 0x727900
":f:cm:M:dVIhEeb:l:L:n:vKrRDTN:W:w:t:u:g:P:G:SQ:O:a:A:x:X:"
        ret = -1
        seed = 2213871821
        rfd = 4
        debug_save = 0
        debug_flag = 0
        dont_fork_cnt = 0
        n_lst = 0x7fff1565c98e
        p = 0xf0b2ff <Address 0xf0b2ff out of bounds>
        __FUNCTION__ = "main"
quit
```

---
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/331

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

[sr-dev] [kamailio] kamailio segfault when doing t_precheck_trans() from tmx.so if Cseq header missed or invalid (#331)