Branch: refs/heads/master
Home: https://github.com/OpenSIPS/opensips
Commit: ac1080e4dedfef2d6d696aba08bc3f03fa5ca57c
https://github.com/OpenSIPS/opensips/commit/ac1080e4dedfef2d6d696aba08bc3f03fa5ca57c
Author: Juanjo Aroztegi <[email protected]>
Date: 2026-10-09 (Fri, 09 Oct 2026)
Changed paths:
M modules/siprec/siprec_sess.c
Log Message:
-----------
siprec: keep the ctx until the dialog is destroyed
The siprec context (struct src_ctx) registers a DLGCB_DESTROY callback
with itself as parameter, but it was freed as soon as its last session
was gone, even if the dialog was still alive. When the SRS rejects the
SIPREC INVITE, the session is only held by the INVITE transaction, so
the ctx is freed when that transaction is deleted, before the dialog
ends. When the dialog is destroyed later, srec_dlg_destroy() writes NULL
to ctx->dlg in the freed chunk. struct src_ctx has the same size as
struct tm_callback and struct dlg_callback (40 bytes on x86_64) and
ctx->dlg sits at the offset of their 'param' field, so when the chunk
has been reused for one of them, the write clears the parameter of a
callback that belongs to another call, which later crashes with a NULL
parameter, e.g. _unref_dlg(dlg=0x0) in the dialog TMCB_TRANS_DELETED
callback or unref_acc_ctx(ctx=0x0) in acc. The same happens when the
SRS does not answer at all and the SIPREC INVITE times out while the
call is still up, or when the SRS answer cannot be used.
Free the ctx only when it has no sessions left and the DLGCB_DESTROY
callback has run. The decision is taken under the ctx lock, together
with unlinking the session, so that when the dialog destruction and the
end of the last session run concurrently in different processes,
exactly one of them frees the ctx.
Fixes #4264
Thanks to @Jperez903 for the report and the debugging data.
To unsubscribe from these emails, change your notification settings at
https://github.com/OpenSIPS/opensips/settings/notifications
_______________________________________________
Devel mailing list
[email protected]
http://lists.opensips.org/cgi-bin/mailman/listinfo/devel
