[OpenSIPS-Devel] [opensips] OpenSIPS 1.10.1 crash (#191)

[Liviu Chircu]

1.10.1-notls
flags: STATS: On, USE_IPV6, USE_TCP, DISABLE_NAGLE, USE_MCAST, SHM_MEM, SHM_MMAP, PKG_MALLOC, F_MALLOC, FAST_LOCK-ADAPTIVE_WAIT ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
@(#) $Id$
main.c compiled on 16:28:56 Mar 28 2014 with gcc 4.7

Installed from tarball.
Backtraces from all processes: http://pastebin.com/ggPG4R52

1000cc traffic
dialog + big sized dialog vars
mi_xmlrpc_ng (doing dlg_list_ctx often)
+ dispatcher, memcache, drouting and mysql

At first sight, relevant part of crash:

msg_translator.c +1539 at:
memcpy(new_buf+offset, buf+s_offset, len-s_offset);

len - s_offset < 0, so memcpy attempts to overwrite 4GB of shm, which, in turn leads to multiple processes crashing

---
Reply to this email directly or view it on GitHub:
https://github.com/OpenSIPS/opensips/issues/191
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opensips.org/pipermail/devel/attachments/20140404/84ae8428/attachment.htm>