[OpenSIPS-Devel] [ opensips-Bugs-2609529 ] Segmentation fault related to 'pua' module

Wed Feb 18 18:34:47 CET 2009

Bugs item #2609529, was opened at 2009-02-17 17:35
Message generated for change (Comment added) made by ibc_sf
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=1086410&aid=2609529&group_id=232389

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: modules
Group: trunk
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Iñaki Baz (ibc_sf)
Assigned to: Anca Vamanu (anca_vamanu)
Summary: Segmentation fault related to 'pua' module

Initial Comment:
OpenSIPS rev 5323.

This OpenSIPS acts as a proxy for presence messages which are routed to an OpenSIPS presence server running in a different port.

syslog:
---------------
/usr/sbin/opensips[20978]: DBG:core:parse_msg:  version: <SIP/2.
/usr/sbin/opensips[20978]: DBG:core:parse_msg:  status:  <489>
/usr/sbin/opensips[20978]: DBG:core:parse_msg:  reason:  <Bad Ev
/usr/sbin/opensips[20978]: DBG:core:parse_headers: flags=2
/usr/sbin/opensips[20978]: DBG:core:parse_via_param: found param
/usr/sbin/opensips[20978]: DBG:core:parse_via: end of header rea
/usr/sbin/opensips[20978]: DBG:core:parse_headers: via found, fl
/usr/sbin/opensips[20978]: DBG:core:parse_headers: this is the f
/usr/sbin/opensips[20978]: DBG:core:receive_msg: After parse_msg
/usr/sbin/opensips[20978]: DBG:core:forward_reply: found module 
/usr/sbin/opensips[20978]: DBG:core:parse_headers: flags=4
/usr/sbin/opensips[20978]: DBG:core:parse_via_param: found param
/usr/sbin/opensips[20978]: DBG:core:parse_via_param: found param
/usr/sbin/opensips[20978]: DBG:core:parse_via_param: found param
/usr/sbin/opensips[20978]: DBG:core:parse_via: end of header rea
/usr/sbin/opensips[20978]: DBG:core:parse_headers: via found, fl
/usr/sbin/opensips[20978]: DBG:core:parse_headers: parse_headers
/usr/sbin/opensips[20978]: DBG:core:forward_reply: found module 
/usr/sbin/opensips[20978]: DBG:tm:t_check: start=0xfffffffffffff
/usr/sbin/opensips[20978]: DBG:core:parse_headers: flags=22
/usr/sbin/opensips[20978]: DBG:core:parse_to_param: tag=82e3ea5b
/usr/sbin/opensips[20978]: DBG:core:parse_to: end of header reac
/usr/sbin/opensips[20978]: DBG:core:parse_to: display={}, ruri={
/usr/sbin/opensips[20978]: DBG:core:get_hdr_field: <To> [63]; ur
/usr/sbin/opensips[20978]: DBG:core:get_hdr_field: to body [<sip
/usr/sbin/opensips[20978]: DBG:core:get_hdr_field: cseq <CSeq>: 
/usr/sbin/opensips[20978]: DBG:tm:t_reply_matching: hash 65085 l
/usr/sbin/opensips[20978]: DBG:tm:t_reply_matching: REF_UNSAFE: 
/usr/sbin/opensips[20978]: DBG:tm:t_reply_matching: reply matche
/usr/sbin/opensips[20978]: DBG:tm:run_trans_callbacks: trans=0x2
/usr/sbin/opensips[20978]: DBG:tm:t_check: end=0x2b936cb4ff10
/usr/sbin/opensips[20978]: DBG:tm:reply_received: org. status ua
/usr/sbin/opensips[20978]:  ## onreply_route[ON_REPLY_DEFAULT]
/usr/sbin/opensips[20978]: DBG:core:tr_eval_string: i=11 j=8
/usr/sbin/opensips[20978]: DBG:core:parse_headers: flags=8000000
/usr/sbin/opensips[20978]: DBG:core:get_hdr_field: content_lengt
/usr/sbin/opensips[20978]: DBG:core:get_hdr_field: found end of 
/usr/sbin/opensips[20978]: DBG:core:pv_get_useragent: no User-Ag
/usr/sbin/opensips[20978]: 15:43:27 - Reply from 99.131.79.216:5
/usr/sbin/opensips[20978]: 489 (SUBSCRIBE): Bad Event
/usr/sbin/opensips[20978]: DBG:tm:t_should_relay_response: T_cod
/usr/sbin/opensips[20978]: DBG:tm:t_pick_branch: picked branch 0
/usr/sbin/opensips[20978]: DBG:tm:is_3263_failure: dns-failover 
/usr/sbin/opensips[20978]: DBG:tm:relay_reply: branch=0, save=0,
/usr/sbin/opensips[20978]: DBG:core:build_res_buf_from_sip_res: 
/usr/sbin/opensips[20978]: DBG:core:build_res_buf_from_sip_res: 
/usr/sbin/opensips[20978]: DBG:core:_shm_resize: resize(0) calle
/usr/sbin/opensips[20978]: DBG:tm:insert_timer_unsafe: [2]: 0x2b
/usr/sbin/opensips[20978]: DBG:tm:relay_reply: sent buf=0x6b7920
/usr/sbin/opensips[20978]: DBG:tm:cleanup_uac_timers: RETR/FR ti
/usr/sbin/opensips[20978]: DBG:tm:t_unref: UNREF_UNSAFE: after i
/usr/sbin/opensips[20978]: DBG:core:destroy_avp_list: destroying
/usr/sbin/opensips[20978]: DBG:core:receive_msg: cleaning up
/usr/sbin/opensips[20934]: DBG:core:tcp_send: buf= SUBSCRIBE sip
/usr/sbin/opensips[20934]: DBG:tm:set_timer: relative timeout is
/usr/sbin/opensips[20934]: DBG:tm:insert_timer_unsafe: [0]: 0x2b
/usr/sbin/opensips[20934]: DBG:tm:t_relay_to: new transaction fw
/usr/sbin/opensips[20934]: DBG:tm:t_unref: UNREF_UNSAFE: after i
/usr/sbin/opensips[20934]: DBG:core:destroy_avp_list: destroying
/usr/sbin/opensips[20934]: DBG:core:receive_msg: cleaning up
/usr/sbin/opensips[20994]: CRITICAL:core:receive_fd: EOF on 46
---------------

coredump:
---------------
Core was generated by `/usr/sbin/opensips -P /var/run/opensips/opensips.pid -m 128 -u opensips -g open'.
Program terminated with signal 11, Segmentation fault.
#0  0x00002b936a901d78 in publ_build_hdr () from /usr/lib/opensips/modules/pua.so
(gdb) bt
#0  0x00002b936a901d78 in publ_build_hdr () from /usr/lib/opensips/modules/pua.so
#1  0x00002b936a8fee4c in bind_pua () from /usr/lib/opensips/modules/pua.so
#2  0x000000000046960c in start_timer_processes ()
#3  0x0000000000423661 in main ()
---------------

----------------------------------------------------------------------

>Comment By: Iñaki Baz (ibc_sf)
Date: 2009-02-18 18:34

Message:
Ok, I'll do that.
BTW my OpenSIPS proxy has crashed now with this backtrace:

------------
#0  0x00002b6c934ffa92 in mysql_stmt_result_metadata () from
/usr/lib/libmysqlclient.so.15
#1  0x00002b6c9338a1de in db_mysql_free_result () from
/usr/lib/opensips/modules/db_mysql.so
#2  0x00002b6c9338b156 in db_mysql_query () from
/usr/lib/opensips/modules/db_mysql.so
#3  0x00002b6c946258f8 in ?? () from /usr/lib/opensips/modules/auth_db.so
#4  0x000000000040f894 in do_action ()
#5  0x000000000040e0f3 in run_action_list ()
#6  0x000000000044c957 in eval_expr ()
#7  0x000000000044c3d0 in eval_expr ()
#8  0x000000000040f939 in do_action ()
#9  0x000000000040e0f3 in run_action_list ()
#10 0x000000000041093a in do_action ()
#11 0x000000000040e0f3 in run_action_list ()
#12 0x000000000041176f in do_action ()
#13 0x000000000040e0f3 in run_action_list ()
#14 0x000000000041176f in do_action ()
#15 0x000000000040e0f3 in run_action_list ()
#16 0x000000000040e480 in run_top_route ()
#17 0x0000000000441b4c in receive_msg ()
#18 0x0000000000464bfd in tcp_read_req ()
#19 0x000000000046691e in tcp_read_req ()
#20 0x0000000000468114 in tcp_receive_loop ()
#21 0x000000000045b83d in tcp_init_children ()
#22 0x000000000042368e in main ()
------------

----------------------------------------------------------------------

Comment By: Anca Vamanu (anca_vamanu)
Date: 2009-02-18 16:39

Message:
Hi Inaki,

Neither the gdb back trace nor the log offer much information. Can you try
to copy the core in the directory where you have the sources and run from
there: 'gdb opensips core'. If still there are no line numbers - run
'ulimit -c unlimited' delete the old core and run the opensips again with
the same usage case to get a new core.
Please print here the output of the gdb back trace with 'bt full'.

regards,
Anca

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=1086410&aid=2609529&group_id=232389