[OpenSIPS-Users] Opensips 2.3 Crash mid-registrar module

[Kirill Galinurov]

Hello. We continue testing Opensips-2.3 with mid-registrar module. Opensips
installed from yum.opensips.org/2.3/nightly/el/7/x86_64/opensips-yum-nightly
repo.
Config file.
loadmodule "mid_registrar.so"
modparam("mid_registrar", "mode", 1) /* 0 = mirror / 1 = ct / 2 = AoR */
modparam("mid_registrar", "outgoing_expires", 7200)
modparam("mid_registrar", "insertion_mode", 0) /* 0 = contact; 1 = path */
modparam("mid_registrar", "max_contacts", 1)
modparam("mid_registrar", "retry_after", 30)
modparam("mid_registrar", "contact_match_param", "rid")


if (is_method("REGISTER")) {
  mid_registrar_save("location", "v");
  switch ($retcode) {
  case 1:
    xlog("L_INFO", "forwarding REGISTER to main registrar ($$ci=$ci)\n");
    $ru = "sip:192.168.10.201:5061";
    if (!t_relay()) {
      send_reply("500", "Server Internal Error 1");
    }

    break;
  case 2:
    xlog("L_INFO", "REGISTER has been absorbed!\n");
    break;
  default:
    xlog("L_ERR", "mid-registrar error!\n");
    send_reply("500", "Server Internal Error 2");
  }

  exit;
}

And it crashed Opensips.

Apr 19 10:32:10 [23576] DBG:mid_registrar:mid_reg_ct_event: Contact
callback (8): contact='sip:2102 at 192.168.76.96:52788;rinstance=1661374fc8fce109;transport=UDP'
| param=(0x7ffff54c59c0 -> (nil)) | data[0]=((nil))

Program received signal SIGSEGV, Segmentation fault.
crcitt_string_array (dst=dst at entry=0x7ffff0e109e1 <from_tag+33> "",
src=src at entry=0x90, size=size at entry=1) at crc.c:225
225      len=src[i].len;

gdb core file:
#0  crcitt_string_array (dst=dst at entry=0x7ffff0e109e1 <from_tag+33> "",
src=src at entry=0x90, size=size at entry=1) at crc.c:225
        i = <optimized out>
        ccitt = 65535
        c = <optimized out>
        len = <optimized out>
        str_len = 4
        __FUNCTION__ = "crcitt_string_array"
#1  0x00007ffff0ba38e5 in generate_fromtag (tag=tag at entry=0x7fffffffdf70,
callid=callid at entry=0x90) at uac.c:118
No locals.
#2  0x00007ffff0b9da37 in new_auto_dlg_uac (_luri=0x80, _turi=0x70,
_ruri=0x10, callid=0x90, _sock=0x0, _d=<optimized out>) at dlg.c:210
        fromtag = {s = 0x1 <Address 0x1 out of bounds>, len = -145797379}
        clid = {s = 0x7ffff77a31c0 <_IO_2_1_stderr_> "\207(\255",
<incomplete sequence \373>, len = -146460574}
#3  0x00007fffef0666a9 in unregister_contact (mri=mri at entry=0x0) at
ulcb.c:122
        dlg = 0x7fff00000020
        ret = <optimized out>
        __FUNCTION__ = "unregister_contact"
#4  0x00007fffef066f30 in mid_reg_ct_event (binding=<optimized out>,
type=<optimized out>, data=<optimized out>) at ulcb.c:173
        c = <optimized out>
        mri = 0x0
        __FUNCTION__ = "mid_reg_ct_event"
#5  0x00007fffefb12a9b in run_ul_callbacks (binding=0x7ffff54c5890, type=8)
at ul_callback.h:126
        cbp = 0x7ffff5223ab8Apr 19 10:32:10 [23576]
DBG:mid_registrar:mid_reg_ct_event: Contact callback (8):
contact='sip:2102 at 192.168.76.96:52788;rinstance=1661374fc8fce109;transport=UDP'
| param=(0x7ffff54c59c0 -> (nil)) | data[0]=((nil))

Program received signal SIGSEGV, Segmentation fault.
crcitt_string_array (dst=dst at entry=0x7ffff0e109e1 <from_tag+33> "",
src=src at entry=0x90, size=size at entry=1) at crc.c:225
225      len=src[i].len;
        ct_extra_idx = 0
        aor_extra_idx = 0
        ele = 0x7ffff5223ad0
#6  wb_timer (ins_list=0x7ffff54afda0, _r=0x7ffff54c5890) at urecord.c:320
        old_state = <optimized out>
        ptr = 0x7ffff54c5890
        t = <optimized out>
        op = <optimized out>
        ins_done = 0
#7  timer_urecord (_r=_r at entry=0x7ffff54abee0,
ins_list=ins_list at entry=0x7ffff54afda0)
at urecord.c:396
No locals.
#8  0x00007fffefb04031 in mem_timer_udomain (_d=<optimized out>) at
udomain.c:1147
        ptr = 0x7ffff54abee0
        dest = <optimized out>
        i = 310
        ret = <optimized out>
        flush = 0
        it = {node = 0x0, map = 0x7ffff54be350}
        prev = {node = 0x7ffff54c57f0, map = 0x7ffff54be350}
        __FUNCTION__ = "mem_timer_udomain"
#9  0x00007fffefb201a1 in synchronize_all_udomains () at dlist.c:803
        res = 0
        ptr = 0x7ffff54afc98
#10 0x00007fffefb20d87 in destroy () at ul_mod.c:492
        __FUNCTION__ = "destroy"
#11 0x00000000004a5d71 in destroy_modules () at sr_module.c:527
        t = 0x7ffff72245a0
        foo = 0x7ffff7224250
        __FUNCTION__ = "destroy_modules"
#12 0x00000000004a2057 in cleanup (show_status=show_status at entry=1) at
main.c:319
        __FUNCTION__ = "cleanup"
#13 0x00000000004a2df2 in handle_sigs () at main.c:522
        chld = <optimized out>
        chld_status = 139
        overall_status = 139
        i = <optimized out>
        do_exit = 1
        __FUNCTION__ = "handle_sigs"
#14 0x000000000041c818 in main_loop () at main.c:722
        startup_done = <optimized out>
        chd_rank = 5
#15 main (argc=<optimized out>, argv=<optimized out>) at main.c:1283
        cfg_stream = <optimized out>
        c = <optimized out>
        r = <optimized out>
        tmp = 0xf0b2e4 <Address 0xf0b2e4 out of bounds>
        tmp_len = <optimized out>
        port = <optimized out>
        proto = <optimized out>
        protos_no = <optimized out>
        options = 0x57c0f8 "f:cCm:M:b:l:n:N:rRvdDFETSVhw:t:u:g:P:G:W😨:"
        seed = 2690059408
        rfd = <optimized out>
        __FUNCTION__ = "main"
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opensips.org/pipermail/users/attachments/20170419/8d8be7c3/attachment.html>