<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#ffffff" text="#000000">
<pre>This message was generated by the Security Alerts service ( Free Trial 14th of August - 14th of September )
<a class="moz-txt-link-freetext" href="http://www.opensips.org/Resources/AlertsMain">http://www.opensips.org/Resources/AlertsMain</a><b>
SVN commit</b>:
<a class="moz-txt-link-freetext" href="http://opensips.svn.sourceforge.net/opensips/?rev=9248&view=rev">http://opensips.svn.sourceforge.net/opensips/?rev=9248&view=rev</a>
<b>Severity</b>: Medium
<b>Version</b> : 1.7, 1.8, trunk
<b>Affected modules</b> : Core
<b>Effect</b> : Timer Route inconsistency
<b>Affected scenarios</b>: If using timer route in relation with functions that try to parse
or change SIP message (like extracting infos - RURI, headers, etc - or add headers or
change RURI) you will experience memory leaks. Also if you are using AVPs in timer
route, they will be inherited by any further execution of the timer route (they will
not be reseted, by they will continuously pile up) and even worst, the AVPs will be
shared by all timer routes at all time. This will lead to unexpected behavior as
AVPs will never be deleted or reset in timer route.
<b>Description</b> : When timer route is internally executed, it does not do cleaning
for the dummy SIP message which is provided, neither frees the list of created
AVPs. Basically the dummy SIP message and the list of AVPs will pile up all
changes or values through the entire execution time of OpenSIPS. <b>
Risks</b> : The memory leaks, but the worst risk is to have non-null list
of AVPs with pre-populated values when a timer route is triggered.
<b>Update</b> :
- if you have an SVN checkout, 1.7, 1.8 and trunk were fixed; so
update to a revision later than 9247 (trunk), 9248 (1.8 branch) or
9249 ( 1.7 branch )
- if you have OpenSIPS from sources, download and apply the patch from
<a class="moz-txt-link-freetext" href="http://opensips.svn.sourceforge.net/viewvc/opensips/trunk/timer.c?r1=9247&r2=9246&pathrev=9247">http://opensips.svn.sourceforge.net/viewvc/opensips/trunk/timer.c?r1=9247&r2=9246&pathrev=9247</a>
or see the attached patch;
- if using tarballs, they were already regenerated (and include the fix)
- If using the official Debian package (apt.opensips.org), they are also
re-generated including the fix
</pre>
<br>
<pre class="moz-signature" cols="72">--
Bogdan-Andrei Iancu
OpenSIPS Founder and Developer
<a class="moz-txt-link-freetext" href="http://www.opensips-solutions.com">http://www.opensips-solutions.com</a></pre>
</body>
</html>