[OpenSIPS-Devel] [ opensips-Bugs-3413995 ] PUBLISH handling causes segfault through update_presentity

[SourceForge.net]

Bugs item #3413995, was opened at 2011-09-26 13:47
Message generated for change (Comment added) made by wdoekes
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=1086410&aid=3413995&group_id=232389

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: modules
Group: 1.7.x
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Walter Doekes (wdoekes)
Assigned to: Nobody/Anonymous (nobody)
Summary: PUBLISH handling causes segfault through update_presentity

Initial Comment:
Hi,

update_presentity() [modules/presence/presentity.c] calls
publ_notify(...&body...) [modules/presence/notify.c where body is allocated on the stack
get_p_notify_body(...publ_body...) [modules/presence/notify.c] attempts to free this

This results in a segfault obviously.

Ugly fix: check for publ_body while doing the Free loop.

Regards,
Walter Doekes
OSSO B.V.

P.S. This bug is not present in 1.6, but is present in trunk and 1.7.

----------------------------------------------------------------------

>Comment By: Walter Doekes (wdoekes)
Date: 2011-09-28 08:37

Message:
I added a new patch, because after fixing the crash, a memory leak became
apparent. (publ_body overwrote an allocated var before freeing it)

The patch also cleans up a bit of the code in the neighbourhood:
- no redundant memsets
- some code formatting

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=1086410&aid=3413995&group_id=232389