[ openser-Bugs-2000515 ] pua: crash in subs_cback_func

[SourceForge.net]

Bugs item #2000515, was opened at 2008-06-23 08:41
Message generated for change (Comment added) made by pge354
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=743020&aid=2000515&group_id=139143

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: modules
Group: ver 1.3.x
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Pablo Guijarro (pge354)
Assigned to: anca (anca_vamanu)
Summary: pua: crash in subs_cback_func

Initial Comment:
From time to time, OpenSER 1.3.1 shuts down due to a segmentation fault in the PUA module while processing the response to a SUBSCRIBE from a XMPP user. Below you can see the information provided by the log file and the backtrace of the core generated.

I suppose that it was not expected to reach that line of code without having "pto" variable set, but the fact is that it happens in some cases, and anyway, the application should not crash.


- Log file:

Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18827]: DBG:pua:subs_cback_func: completed with status 202
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18827]: DBG:core:parse_headers: flags=ffffffffffffffff
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18827]: DBG:core:get_hdr_field: content_length=0
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18827]: DBG:core:get_hdr_field: found end of header
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18827]: DBG:pua:subs_cback_func: lexpire= 180
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18827]: DBG:pua:get_dialog: core_hash= 427
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18842]: CRITICAL:core:receive_fd: EOF on 16
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18820]: INFO:core:handle_sigs: child process 18827 exited by a signal 11
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18842]: DBG:core:handle_ser_child: dead child 6, pid 18827 (shutting down?)
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18820]: INFO:core:handle_sigs: core was generated
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18820]: INFO:core:handle_sigs: terminating due to SIGCHLD
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18840]: INFO:core:sig_usr: signal 15 received
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18842]: INFO:core:sig_usr: signal 15 received
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18839]: INFO:core:sig_usr: signal 15 received
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18837]: INFO:core:sig_usr: signal 15 received
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18838]: INFO:core:sig_usr: signal 15 received
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18832]: INFO:core:sig_usr: signal 15 received
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18831]: INFO:core:sig_usr: signal 15 received
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18830]: INFO:core:sig_usr: signal 15 received
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18835]: INFO:core:sig_usr: signal 15 received
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18823]: INFO:core:sig_usr: signal 15 received
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18825]: INFO:core:sig_usr: signal 15 received
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18824]: INFO:core:sig_usr: signal 15 received
Jun  9 07:49:29 cmovil /usr/local/sbin/openser[18822]: INFO:core:sig_usr: signal 15 received


- Backtrace:


Core was generated by `/usr/local/sbin/openser -P /var/run/openser.pid -m 64'.
Program terminated with signal 11, Segmentation fault.
#0  0xb78be14f in subs_cback_func (t=0xb3a538e8, cb_type=256, ps=0xb7ba2234) at send_subscribe.c:454
454             size= sizeof(ua_pres_t)+ 2*sizeof(str)+( pto->uri.len+

(gdb) backtrace
#0  0xb78be14f in subs_cback_func (t=0xb3a538e8, cb_type=256, ps=0xb7ba2234) at send_subscribe.c:454
#1  0xb7b7a0d7 in run_trans_callbacks (type=256, trans=0xb3a538e8, req=0x0, rpl=0x818f6f8, code=202) at t_hooks.c:205
#2  0xb7b92cb1 in local_reply (t=0xb3a538e8, p_msg=0x818f6f8, branch=0, msg_status=202, cancel_bitmap=0xbfcc5730) at t_reply.c:1245
#3  0xb7b95844 in reply_received (p_msg=0x818f6f8) at t_reply.c:1384
#4  0x08063e08 in forward_reply (msg=0x818f6f8) at forward.c:499
#5  0x08094372 in receive_msg (
    buf=0x8165000 "SIP/2.0 202 OK\r\nVia: SIP/2.0/UDP 192.168.1.33;branch=z9hG4bKb79c.15401d07.0\r\nTo: sip:jesus@...;tag=10.16365.1213770124.16\r\nFrom: sip:jveglop*gmail.com@gw;tag=533cb9e91f4b999cf76861cbb9ed54ed-55"..., len=368, rcv_info=0xbfcc5864) at receive.c:194
#6  0x080d4063 in udp_rcv_loop () at udp_server.c:438
#7  0x0806c506 in main (argc=5, argv=0xbfcc5a44) at main.c:834


----------------------------------------------------------------------

>Comment By: Pablo Guijarro (pge354)
Date: 2008-07-08 07:46

Message:
Logged In: YES
user_id=2125847
Originator: YES

Hi,

The expected:

(gdb) print *pto
Cannot access memory at address 0x0
(gdb) print pto->uri
Cannot access memory at address 0xc

May it help, pfrom variable has no value either:

(gdb) print *pfrom
Cannot access memory at address 0x0

Regards,
Pablo


----------------------------------------------------------------------

Comment By: anca (anca_vamanu)
Date: 2008-07-07 16:29

Message:
Logged In: YES
user_id=1614776
Originator: NO

Hi,

If you still have the core please investigate a bit more. Run the
comands:
print *pto and print pto->uri and send the results.

regards,
Anca Vamanu

----------------------------------------------------------------------

You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=743020&aid=2000515&group_id=139143

_______________________________________________
Devel mailing list
Devel@...
http://lists.openser.org/cgi-bin/mailman/listinfo/devel