[OpenSIPS-Devel] [OpenSIPS/opensips] e0f176: b2b_entities: apply lumps on faked requests instea...

[Bogdan Andrei IANCU]

  Branch: refs/heads/master
  Home:   https://github.com/OpenSIPS/opensips
  Commit: e0f176937991e59d3b6c9a2158f046cb2940959c
      https://github.com/OpenSIPS/opensips/commit/e0f176937991e59d3b6c9a2158f046cb2940959c
  Author: Norm Brandinger <n.brandinger at gmail.com>
  Date:   2026-06-15 (Mon, 15 Jun 2026)

  Changed paths:
    M modules/b2b_entities/dlg.c
    M modules/tm/t_msgbuilder.h
    M parser/msg_parser.h

  Log Message:
  -----------
  b2b_entities: apply lumps on faked requests instead of dropping them (GH-3796)

The previous proposed fix for the b2b_init_request()-from-async-resume crash
simply skipped b2b_apply_lumps() for FL_TM_FAKE_REQ messages.  That avoids the
crash but, as noted in review, silently discards any lump/change applied before
the async jump (record_route, append_hf, SDP edits, ...), so they never reach
the request b2b builds its entities from.

A faked request is a hybrid: fix_fake_req_headers()/clone_headers() give it a
single pkg block of header nodes, but the nodes' parsed sub-structures and the
message buffer still live in the SHM transaction clone.  The generic in-place
path in b2b_apply_lumps() (free_sip_msg() then reparse into the same buffer)
therefore (a) pkg_free()s SHM parsed structures -> the GH-3796 abort, and
(b) would overwrite the SHM clone buffer.

Instead, for FL_TM_FAKE_REQ, flatten the lumps into a private pkg buffer, parse
it into a fresh, fully pkg-owned sip_msg, and graft that self-contained state
onto the faked request, carrying over the pkg fields fake_req() set up.  The new
FL_TM_FAKE_REQ_REBUILT flag tells tm's free_faked_req() to release the message
as a standalone pkg sip_msg rather than via the clone-relative teardown (which
assumes an SHM buffer and a single-block pkg header list).

Reproduced and verified on aarch64 with a DBG_MALLOC build: the worker no longer
aborts in free_via_param_list()/qm_free_dbg(), and the pre-async record_route
and append_hf lumps are present on the rebuilt request.

Refs: https://github.com/OpenSIPS/opensips/issues/3796


  Commit: 434162dd615893c5dd3340295e982b2a3f23cd4a
      https://github.com/OpenSIPS/opensips/commit/434162dd615893c5dd3340295e982b2a3f23cd4a
  Author: Bogdan Andrei IANCU <bogdan at opensips.org>
  Date:   2026-06-22 (Mon, 22 Jun 2026)

  Changed paths:
    M modules/b2b_entities/dlg.c
    M modules/tm/t_msgbuilder.h
    M parser/msg_parser.h

  Log Message:
  -----------
  Merge pull request #3822 from NormB/fix/gh3796-b2b-async-crash

b2b_entities: fix crash calling b2b_init_request from async resume route


Compare: https://github.com/OpenSIPS/opensips/compare/6842b5240394...434162dd6158

To unsubscribe from these emails, change your notification settings at https://github.com/OpenSIPS/opensips/settings/notifications