{"action":"created","issue":{"url":"https://api.github.com/repos/OpenSIPS/opensips/issues/1008","repository_url":"https://api.github.com/repos/OpenSIPS/opensips","labels_url":"https://api.github.com/repos/OpenSIPS/opensips/issues/1008/labels{/name}","comments_url":"https://api.github.com/repos/OpenSIPS/opensips/issues/1008/comments","events_url":"https://api.github.com/repos/OpenSIPS/opensips/issues/1008/events","html_url":"https://github.com/OpenSIPS/opensips/issues/1008","id":196732570,"number":1008,"title":"Dialog crash when sequential requests are processed in parallel","user":{"login":"razvancrainea","id":1511224,"avatar_url":"https://avatars3.githubusercontent.com/u/1511224?v=3","gravatar_id":"","url":"https://api.github.com/users/razvancrainea","html_url":"https://github.com/razvancrainea","followers_url":"https://api.github.com/users/razvancrainea/followers","following_url":"https://api.github.com/users/razvancrainea/following{/other_user}","gists_url":"https://api.github.com/users/razvancrainea/gists{/gist_id}","starred_url":"https://api.github.com/users/razvancrainea/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/razvancrainea/subscriptions","organizations_url":"https://api.github.com/users/razvancrainea/orgs","repos_url":"https://api.github.com/users/razvancrainea/repos","events_url":"https://api.github.com/users/razvancrainea/events{/privacy}","received_events_url":"https://api.github.com/users/razvancrainea/received_events","type":"User","site_admin":false},"labels":[{"id":39042785,"url":"https://api.github.com/repos/OpenSIPS/opensips/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"closed","locked":false,"assignee":{"login":"razvancrainea","id":1511224,"avatar_url":"https://avatars3.githubusercontent.com/u/1511224?v=3","gravatar_id":"","url":"https://api.github.com/users/razvancrainea","html_url":"https://github.com/razvancrainea","followers_url":"https://api.github.com/users/razvancrainea/followers","following_url":"https://api.github.com/users/razvancrainea/following{/other_user}","gists_url":"https://api.github.com/users/razvancrainea/gists{/gist_id}","starred_url":"https://api.github.com/users/razvancrainea/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/razvancrainea/subscriptions","organizations_url":"https://api.github.com/users/razvancrainea/orgs","repos_url":"https://api.github.com/users/razvancrainea/repos","events_url":"https://api.github.com/users/razvancrainea/events{/privacy}","received_events_url":"https://api.github.com/users/razvancrainea/received_events","type":"User","site_admin":false},"assignees":[{"login":"razvancrainea","id":1511224,"avatar_url":"https://avatars3.githubusercontent.com/u/1511224?v=3","gravatar_id":"","url":"https://api.github.com/users/razvancrainea","html_url":"https://github.com/razvancrainea","followers_url":"https://api.github.com/users/razvancrainea/followers","following_url":"https://api.github.com/users/razvancrainea/following{/other_user}","gists_url":"https://api.github.com/users/razvancrainea/gists{/gist_id}","starred_url":"https://api.github.com/users/razvancrainea/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/razvancrainea/subscriptions","organizations_url":"https://api.github.com/users/razvancrainea/orgs","repos_url":"https://api.github.com/users/razvancrainea/repos","events_url":"https://api.github.com/users/razvancrainea/events{/privacy}","received_events_url":"https://api.github.com/users/razvancrainea/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2016-12-20T17:30:36Z","updated_at":"2017-03-24T17:06:33Z","closed_at":"2017-03-24T10:39:46Z","body":"When two requests are processed in parallel (like re-transmissions for re-INIVTEs), changing the dialog structure without locks is unsafe and can lead to crashes. In this particular case, calling `switch_cseqs` and `update_cseqs` without locking the dialog can lead to an invalid memory access:\r\n\r\n```\r\nCRITICAL:core:qm_realloc: trying to realloc an already freed pointer 0x7f5eaa1519f8 , fragment 0x7f5eaa1519c8 -- aborting\r\n```\r\n```\r\n(gdb) p *(struct qm_frag*) ((char*)0x7f5eaa0a94c8-sizeof(struct qm_frag))\r\n$5 = {size = 48, u = {nxt_free = 0x0, is_free = 0}, file = 0x7f5ea20eeeaa \"dlg_handlers.c\", \r\n  func = 0x7f5ea20f2ad5 <__FUNCTION__.11478> \"switch_cseqs\", line = 1333, check = 17361641481138401520}\r\n(gdb) p *(struct qm_frag*) ((char*)0x7f5eaa1519f8-sizeof(struct qm_frag))\r\n$6 = {size = 8, u = {nxt_free = 0x7f5ea89f10a8, is_free = 140044532650152}, file = 0x7f5ea20eeeaa \"dlg_handlers.c\", \r\n  func = 0x7f5ea20f2ad5 <__FUNCTION__.11478> \"switch_cseqs\", line = 1333, check = 17361641481138401520}\r\n```\r\n\r\nA possible fix in the script is to call `t_newtran()` as soon as possible for sequential requests:\r\n```\r\nif (has_totag())\r\n    t_newtran();\r\n```"},"comment":{"url":"https://api.github.com/repos/OpenSIPS/opensips/issues/comments/289083080","html_url":"https://github.com/OpenSIPS/opensips/issues/1008#issuecomment-289083080","issue_url":"https://api.github.com/repos/OpenSIPS/opensips/issues/1008","id":289083080,"user":{"login":"flydoc","id":12986089,"avatar_url":"https://avatars0.githubusercontent.com/u/12986089?v=3","gravatar_id":"","url":"https://api.github.com/users/flydoc","html_url":"https://github.com/flydoc","followers_url":"https://api.github.com/users/flydoc/followers","following_url":"https://api.github.com/users/flydoc/following{/other_user}","gists_url":"https://api.github.com/users/flydoc/gists{/gist_id}","starred_url":"https://api.github.com/users/flydoc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/flydoc/subscriptions","organizations_url":"https://api.github.com/users/flydoc/orgs","repos_url":"https://api.github.com/users/flydoc/repos","events_url":"https://api.github.com/users/flydoc/events{/privacy}","received_events_url":"https://api.github.com/users/flydoc/received_events","type":"User","site_admin":false},"created_at":"2017-03-24T17:06:33Z","updated_at":"2017-03-24T17:06:33Z","body":"Excellent , thanks  \n\n\n> On 24 Mar 2017, at 10:39, Răzvan Crainea <notifications@github.com> wrote:\n> \n> Closed #1008 <https://github.com/OpenSIPS/opensips/issues/1008> via 596fb1f <https://github.com/OpenSIPS/opensips/commit/596fb1f3d4b227185556a992dbd9945fed206f5e>.\n> \n> —\n> You are receiving this because you commented.\n> Reply to this email directly, view it on GitHub <https://github.com/OpenSIPS/opensips/issues/1008#event-1014048834>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AMYm6RspNmWddjlfAKZ7yL8eO2y2O-Kjks5ro510gaJpZM4LSF8h>.\n> \n\n\n"}}
{"actor":{"display_login":"flydoc"}}