<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Arial; font-size: 12pt; color: #000000'><P><BR>Kamailio 1.5.4 crashes with the following backtrace.</P>
<P> </P>
<P>(gdb) bt<BR>#0 free_to_params (tb=0x79ffc0) at parser/parse_to.c:79<BR>#1 free_to (tb=0x79ffc0) at parser/parse_to.c:88<BR>#2 0x000000000047fe82 in clean_hdr_field (hf=0x2b32776ec6a0) at parser/hf.c:187<BR>#3 0x00002b327492f525 in clean_msg_clone (type=<value optimized out>, trans=<value optimized out>, req=0x2b32776eb510, rpl=0x79f220, code=<value optimized out>) at sip_msg.h:54<BR>#4 run_trans_callbacks (type=<value optimized out>, trans=<value optimized out>, req=0x2b32776eb510, rpl=0x79f220, code=<value optimized out>) at t_hooks.c:245<BR>#5 0x00002b3274949a1d in relay_reply (t=0x2b32776ed130, p_msg=0x79f220, branch=<value optimized out>, msg_status=200, cancel_bitmap=0x7fff5438ecf8) at t_reply.c:1163<BR>#6 0x00002b327494a123 in reply_received (p_msg=0x79f220) at t_reply.c:1511<BR>#7 0x000000000041f08b in forward_reply (msg=0x79f220) at forward.c:576<BR>#8 0x0000000000445453 in receive_msg (<BR> buf=0x719200 "SIP/2.0 200 OK\r\nVia: SIP/2.0/UDP xxx.xxx.xxx.114;branch=z9hG4bKb415.46c549d2.0\r\nVia: SIP/2.0/UDP xx.xxx.xx.xxx:5060;received=xxx.xxx.xx.xxx;branch=z9hG4bK6cd2ebfb;rport=5060\r\nRecord-Route: <sip:xxx.xxx.xxx.x"..., len=1106, rcv_info=0x7fff5438ede0) at receive.c:212<BR>#9 0x00000000004795ee in udp_rcv_loop () at udp_server.c:449<BR>#10 0x000000000042774e in main_loop (argc=3, argv=0x7fff5438eff8) at main.c:774<BR>#11 main (argc=3, argv=0x7fff5438eff8) at main.c:1321</P>
<P> </P>
<P> </P>
<P>This is occuring on a centos box, 2.6.18-164.11.1.el5 #1 SMP Wed Jan 20 07:32:21 EST 2010 x86_64 x86_64 x86_64 GNU/Linux</P>
<P> </P>
<P> </P>
<P>The really strange thing is the source of the problem appears to be in clean_hdr_field (hf=0x2b32776ec6a0) at parser/hf.c:187</P>
<P> </P>
<P>void clean_hdr_field(struct hdr_field* hf)<BR>{ <BR> if (hf->parsed){<BR> switch(hf->type){</P>
<P>...</P>
<P> case HDR_RPID_T:<BR> free_to(hf->parsed);<BR> break;</P>
<P>...</P>
<P> </P>
<P>output from gdb shows hf->parsed to be NULL, however the call to free_to(hf->parsed) is being called, from there bad things happen.</P>
<P> </P>
<P>Thanks in advance.</P>
<P>Gene</P>
<P> </P>
<P> </P></div></body></html>