[OpenSIPS-Devel] [ opensips-Bugs-3511795 ] Multiple Max Forward headers in MWI Notify

Tue Apr 3 17:08:12 CEST 2012

Bugs item #3511795, was opened at 2012-03-27 00:43
Message generated for change (Comment added) made by vladut-paiu
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=1086410&aid=3511795&group_id=232389

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: core
Group: 1.7.x
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Muhammad Shahzad (shari_786pk)
Assigned to: Vladut-Stefan Paiu (vladut-paiu)
Summary: Multiple Max Forward headers in MWI Notify

Initial Comment:
I am getting multiple Max Forward headers in NOTIFY message generated by opensips for MWI event.

========================================
NOTIFY sip:923224005403 at x.x.x.x:50010 SIP/2.0
Via: SIP/2.0/UDP y.y.y.y;branch=z9hG4bK99ce.acfe442.0
To: <sip:92804209211 at osips.mydomain.com>;tag=3336993885
From: <sip:92804209211 at osips.mydomain.com>;tag=920cb12f0fa328d3fbdc2950c5127229-243f
CSeq: 2 NOTIFY
Call-ID: 003F094D-4876-E111-8985-0800270008CB at x.x.x.x
Max-Forwards: 70
Content-Length: 0
User-Agent: OSIP v1.7.2-8862
Max-Forwards: 70
Event: message-summary
Contact: <sip:presence at y.y.y.y:6000>
Subscription-State: terminated;reason=timeout
========================================

I am using opensips stable branch 1.7 with SVN revision 8862. Output of "opensips -V" is,

==============================================
version: opensips 1.7.2-tls (x86_64/linux)
flags: STATS: Off, USE_IPV6, USE_TCP, USE_TLS, USE_SCTP, DISABLE_NAGLE, USE_MCAST, SHM_MEM, SHM_MMAP, PKG_MALLOC, F_MALLOC, FAST_LOCK-ADAPTIVE_WAIT
ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
svnrevision: 2:8860M
@(#) $Id: main.c 8537 2011-11-08 17:02:11Z bogdan_iancu $
main.c compiled on 07:23:52 Mar 27 2012 with gcc 4.5.2
==============================================

Please suggest.

----------------------------------------------------------------------

>Comment By: Vladut-Stefan Paiu (vladut-paiu)
Date: 2012-04-03 08:08

Message:
Hi, 

Please open a new ticket for these crashes, as the source issue of the
ticket has been fixed.

Regards,
Vlad

----------------------------------------------------------------------

Comment By: Muhammad Shahzad (shari_786pk)
Date: 2012-03-27 06:42

Message:
Crashed again. Seems like problem is in tm.c at line 1129, where it is
getting address out of bounds.

============================================================
Core was generated by `/usr/local/sbin/opensips -P /var/run/opensips.pid -m
512 -u root -g root'.
Program terminated with signal 11, Segmentation fault.
#0  fm_malloc (qm=0x96a3c000, size=4048) at mem/f_malloc.c:329
/usr/src/svn-src/opensips_1_7/mem/f_malloc.c:329:8173:beg:0x80ff5f7
(gdb) bt
#0  fm_malloc (qm=0x96a3c000, size=4048) at mem/f_malloc.c:329
#1  0xb71265bc in shm_malloc (p_msg=0x82904e4) at ../../mem/shm_mem.h:202
#2  build_cell (p_msg=0x82904e4) at h_table.c:255
#3  0xb714056e in new_t (p_msg=0x82904e4) at t_lookup.c:973
#4  t_newtran (p_msg=0x82904e4) at t_lookup.c:1081
#5  0xb71326e2 in t_relay_to (p_msg=0x82904e4, proxy=0x0, flags=18) at
t_funcs.c:199
#6  0xb7142595 in w_t_relay (p_msg=0x82904e4, proxy=0x0, flags=0x12
<Address 0x12 out of bounds>) at tm.c:1129
#7  0x080599b2 in do_action (a=0x8232754, msg=0x0) at action.c:1280
#8  0x08058139 in run_action_list (a=0x8232754, msg=0x82904e4) at
action.c:141
#9  0x080b4d69 in eval_elem (e=0x82327c0, msg=0x82904e4, val=0x1fa) at
route.c:1398
#10 0x080b64ab in eval_expr (e=0x82327c0, msg=0x0, val=0x1fa) at
route.c:1743
#11 0x080b6428 in eval_expr (e=0x82327ec, msg=0x0, val=0x0) at
route.c:1759
#12 0x080b645d in eval_expr (e=0x8232818, msg=0x0, val=0x1fa) at
route.c:1764
#13 0x08058a2f in do_action (a=0x823293c, msg=0x82904e4) at action.c:830
#14 0x08058139 in run_action_list (a=0x8217efc, msg=0x82904e4) at
action.c:141
#15 0x0805b9d3 in run_actions (a=0x820bf20, msg=0x0) at action.c:121
#16 do_action (a=0x820bf20, msg=0x0) at action.c:504
#17 0x08058139 in run_action_list (a=0x820bf20, msg=0x82904e4) at
action.c:141
#18 0x0805c093 in do_action (a=0x820c21c, msg=0x82904e4) at action.c:847
#19 0x08058139 in run_action_list (a=0x820bafc, msg=0x82904e4) at
action.c:141
#20 0x0805c093 in do_action (a=0x820cbf0, msg=0x82904e4) at action.c:847
#21 0x08058139 in run_action_list (a=0x820cbf0, msg=0x82904e4) at
action.c:141
#22 0x0805c093 in do_action (a=0x820ccc8, msg=0x82904e4) at action.c:847
#23 0x08058139 in run_action_list (a=0x8202620, msg=0x82904e4) at
action.c:141
#24 0x0805dcd8 in run_actions (a=0x8202620, msg=0x82904e4) at action.c:121
#25 run_top_route (a=0x8202620, msg=0x82904e4) at action.c:182
#26 0x080a3a4e in receive_msg (
    buf=0x81d02e0 "BYE sip:%2b4745208005 at 77.66.2.136:5070 SIP/2.0\r\nVia:
SIP/2.0/UDP
94.102.175.38:5060;branch=z9hG4bKeu579r10e0e0ajg6g1c0sd0000g00.1\r\nCall-ID:
75a68c7670c0d8bf76f0171e20039360 at 77.66.2.136\r\nFrom: <sip:486"...,
len=490, rcv_info=0xbfae77b8) at receive.c:165
#27 0x080f9973 in udp_rcv_loop () at udp_server.c:418
#28 0x080743b0 in main_loop (argc=9, argv=0xbfae7974) at main.c:872
#29 main (argc=9, argv=0xbfae7974) at main.c:1490
============================================================

Thank you.

----------------------------------------------------------------------

Comment By: Muhammad Shahzad (shari_786pk)
Date: 2012-03-27 06:32

Message:
Seems to work now, but now i am getting opensips crash, not sure if its
related to this fix or not. Here is core dump trace,

===========================================================
Core was generated by `/usr/local/sbin/opensips -P /var/run/opensips.pid -m
512 -u root -g root'.
Program terminated with signal 11, Segmentation fault.
#0  0x0812dd0e in clone_sdp_stream_cell (stream=0x829a7c4) at
parser/sdp/sdp.c:1071
/usr/src/svn-src/opensips_1_7/parser/sdp/sdp.c:1071:29011:beg:0x812dd0e
(gdb) bt
#0  0x0812dd0e in clone_sdp_stream_cell (stream=0x829a7c4) at
parser/sdp/sdp.c:1071
#1  0x0812e0b9 in clone_sdp_session_cell (session=0x82969e0) at
parser/sdp/sdp.c:1141
#2  0xb7058c7a in add_pending_sdp_session (qos_ctx=0x9711006c, dir=1,
cseq_number=0x82a138c, cseq_method=0x82a1394, cseq_method_id=1, role=0,
negotiation=1,
    session=0x82969e0, _m=0x8290550) at qos_ctx_helpers.c:356
#3  0xb705b31a in add_sdp (qos_ctx=0x9711006c, dir=1, _m=0x8290550, role=0,
other_role=1) at qos_ctx_helpers.c:433
#4  0xb705bf15 in qos_dialog_created_CB (did=0x9724d084, type=2,
params=0xb71afd68) at qos_handlers.c:155
#5  0xb717eb43 in run_create_callbacks (dlg=0x9724d084, msg=0x8290550) at
dlg_cb.c:231
#6  0xb7187050 in dlg_onreq (t=0x9757f1c0, type=1, param=0xbfd7d1d4) at
dlg_handlers.c:825
#7  0xb71e47b9 in run_reqin_callbacks (trans=0x9757f1c0, req=0x8290550,
code=1) at t_hooks.c:248
#8  0xb71d3667 in build_cell (p_msg=0x8290550) at h_table.c:289
#9  0xb71ed56e in new_t (p_msg=0x8290550) at t_lookup.c:973
#10 t_newtran (p_msg=0x8290550) at t_lookup.c:1081
#11 0xb71df6e2 in t_relay_to (p_msg=0x8290550, proxy=0x0, flags=18) at
t_funcs.c:199
#12 0xb71ef595 in w_t_relay (p_msg=0x8290550, proxy=0x0, flags=0x12
<Address 0x12 out of bounds>) at tm.c:1129
#13 0x080599b2 in do_action (a=0x823e5d8, msg=0xfffffff7) at action.c:1280
#14 0x08058139 in run_action_list (a=0x823e5d8, msg=0x8290550) at
action.c:141
#15 0x080b4d69 in eval_elem (e=0x823e644, msg=0x8290550, val=0x3fbf7a25) at
route.c:1398
#16 0x080b64ab in eval_expr (e=0x823e644, msg=0xfffffff7, val=0x3fbf7a25)
at route.c:1743
#17 0x080b6428 in eval_expr (e=0x823e670, msg=0xfffffff7, val=0x0) at
route.c:1759
#18 0x080b645d in eval_expr (e=0x823e69c, msg=0xfffffff7, val=0x3fbf7a25)
at route.c:1764
#19 0x08058a2f in do_action (a=0x823e944, msg=0x8290550) at action.c:830
#20 0x08058139 in run_action_list (a=0x823ad8c, msg=0x8290550) at
action.c:141
#21 0x0805b9d3 in run_actions (a=0x8235478, msg=0xfffffff7) at
action.c:121
#22 do_action (a=0x8235478, msg=0xfffffff7) at action.c:504
#23 0x08058139 in run_action_list (a=0x8235274, msg=0x8290550) at
action.c:141
#24 0x0805c093 in do_action (a=0x82354e4, msg=0x8290550) at action.c:847
#25 0x08058139 in run_action_list (a=0x8232c2c, msg=0x8290550) at
action.c:141
#26 0x0805b9d3 in run_actions (a=0x822b480, msg=0xfffffff7) at
action.c:121
#27 do_action (a=0x822b480, msg=0xfffffff7) at action.c:504
#28 0x08058139 in run_action_list (a=0x822b480, msg=0x8290550) at
action.c:141
#29 0x0805cc32 in do_action (a=0x822b4ec, msg=0x8290550) at action.c:853
#30 0x08058139 in run_action_list (a=0x822ae38, msg=0x8290550) at
action.c:141
#31 0x0805cc32 in do_action (a=0x822b558, msg=0x8290550) at action.c:853
#32 0x08058139 in run_action_list (a=0x8218e38, msg=0x8290550) at
action.c:141
#33 0x0805c093 in do_action (a=0x82325d0, msg=0x8290550) at action.c:847
#34 0x08058139 in run_action_list (a=0x8217efc, msg=0x8290550) at
action.c:141
#35 0x0805b9d3 in run_actions (a=0x8212cd4, msg=0xfffffff7) at
action.c:121
#36 do_action (a=0x8212cd4, msg=0xfffffff7) at action.c:504
#37 0x08058139 in run_action_list (a=0x8202620, msg=0x8290550) at
action.c:141
#38 0x0805dcd8 in run_actions (a=0x8202620, msg=0x8290550) at action.c:121
#39 run_top_route (a=0x8202620, msg=0x8290550) at action.c:182
#40 0x080a3a4e in receive_msg (
---Type <return> to continue, or q <return> to quit---
    buf=0x81d02e0 "INVITE sip:00919891454451 at rtsip.vopium.com:6000
SIP/2.0\r\nVia: SIP/2.0/UDP
98.191.213.89:49600;rport;branch=z9hG4bKPjNuuOq8gaJX2PyUhajN-dPGN2gdndtjgs\r\nMax-Forwards:
69\r\nFrom: sip:15712529174 at rtsip.vopi"..., len=1460, rcv_info=0xbfd7f648)
at receive.c:165
#41 0x080f9973 in udp_rcv_loop () at udp_server.c:418
#42 0x080743b0 in main_loop (argc=9, argv=0xbfd7f804) at main.c:872
#43 main (argc=9, argv=0xbfd7f804) at main.c:1490
===========================================================

Please help.

Thank you.

----------------------------------------------------------------------

Comment By: Vladut-Stefan Paiu (vladut-paiu)
Date: 2012-03-27 01:15

Message:
Hi,

This issue was fixed in trunk and 1.8 branches, but I've forgotten to
backport ti to 1.7 as well.
Just backported the fixes, please give it a try.

Thanks and Regards,
Vlad

----------------------------------------------------------------------

Comment By: Muhammad Shahzad (shari_786pk)
Date: 2012-03-27 00:46

Message:
seems i didn't change phone number's all occurrences in the NOTIFY message,
:)

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=1086410&aid=3511795&group_id=232389