How to reproduce it:

# curl -H "Content-type: text/html" -d
"uel&from=1010&to=111111&text=Invalid Keyword&binfo="
http://127.0.0.1:13002/cgi-bin/sendsms


Logs:

2007-01-10 15:56:05 [13414] [3] PANIC: gwlib/octstr.c:2476:
seems_valid_real: Assertion `ostr->data != NULL' failed. (Called from
gwlib/octstr.c:318:octstr_destroy.)
2007-01-10 15:56:05 [13414] [1] DEBUG: HTTP: Destroying HTTPClient
area 0x8159a90.
2007-01-10 15:56:05 [13414] [1] DEBUG: HTTP: Destroying HTTPClient for
`127.0.0.1'.
2007-01-10 15:56:05 [13414] [3] PANIC: gw/smsbox(gw_panic+0xcc) [0x808845c]
2007-01-10 15:56:05 [13414] [3] PANIC: gw/smsbox [0x80896e8]
2007-01-10 15:56:05 [13414] [3] PANIC: gw/smsbox(octstr_destroy+0x2a)
[0x8089dfa]
2007-01-10 15:56:05 [13414] [3] PANIC: gw/smsbox [0x805b3ff]
2007-01-10 15:56:05 [13414] [3] PANIC: gw/smsbox [0x807f070]
2007-01-10 15:56:05 [13414] [3] PANIC: /lib/libpthread.so.0 [0xb7f2e604]
2007-01-10 15:56:05 [13414] [3] PANIC: /lib/libc.so.6(__clone+0x5e) [0xb7c5c09e]

Problem:
The var body is filled with the pointer to text and then destroyed twice-


Fixed in the attached Patch.

Martin.
--- gw/smsbox.c.orig	2007-01-10 16:07:01.566692000 -0300
+++ gw/smsbox.c	2007-01-10 16:06:44.777642750 -0300
@@ -2601,7 +2601,8 @@
 	text = html_to_sms(body);
 	octstr_strip_blanks(text);
 	octstr_destroy(body);
-	body = text;
+	body = octstr_duplicate(text);
+	octstr_destroy(text);
 	get_x_kannel_from_headers(headers, &from, &to, &udh,
 				  &user, &pass, &smsc, &mclass, &mwi, 
 				  &coding, &compress, &validity, 

Reply via email to