<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:10pt"><div>Hi</div><div><br></div><div><span style="font-size: 10pt;">We think that we found and fix a bug in the registrar module. The bug is hard to reproduce, and it crashes our Kamailio from time to time (once at 2-3 weeks for us) .</span><br></div><div><br></div><div>In save.c, function update_contacts() there are two places where we free() a pointer and then we reuse it, line 700 and line 730:</div><div><br></div><div>while(ptr){</div><div><br></div><div> ptr0 = ptr;</div><div> if(ptr!=c)</div><div> ul.delete_ucontact(_r, ptr);</div><div> ptr=ptr0->next;</div><div>}</div><div><br></div><div><br></div><div>And then from inside delete_ucontact(_r,ptr) we call
mem_delete_ucontact(_r, _c) which calls </div><div>free_ucontact(_c) , which calls shm_free(_c) . _c is actually our ptr.</div><div><br></div><div>If another process writes at the location pointed by ptr during the "while" loop , the current process will crash.</div><div><br></div><div>The bug affects 4.0.4, 4.0.5 and maybe older versions.</div><div><br></div><div>We keep the location table in memory, no database backend, and we do alot of REGISTER/un-REGISTER in our environment,</div><div>and maybe that's why this bug was not spotted by the community before.</div><div><br></div><div><span style="font-size: 10pt;">Just to clarify, this fix is in relation with this post:</span><br></div><div>http://lists.sip-router.org/pipermail/sr-dev/2014-February/022934.html</div><div><br></div><div><span style="font-size: 10pt;">Please take into consideration the attached patch provided by the Libon Voice
Team.</span><br></div><div><br></div><div>Regards,</div><div>Dragos Oancea</div><div><br></div></div></body></html>