Apologies if i have not kept with the reporting standard.

Insertion attempts of out-of-credit replies from resume_on_initial_ccr callback, are corrupting the ro_session list. i.e. they nullify the first and last fields, which under certain conditions the first entry gets restored but not the last.This then crashes the process at ro_session_hash.c (link_ro_session), where the first entry has a valid address but the last does not.
Solution: ro_session_hash.h - unlink_unsafe_ro_session - check if the session to be linked is actually part of list i.e

    if ((ro_session->next == 0x00) &&
    (ro_session->prev == 0x00) &&
    (ro_session != ro_session_entry->first) )
{
             ro_session, &(ro_session->ro_tl),
             ro_session->callid.len,
             ro_session->callid.len,
             ro_session->callid.s);
    return;
}

rest of the code ....

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.