Module: kamailio Branch: 6.1 Commit: 25099a1f9e3f3ebb5b3c19ca51e4d5c5fdc6a0c8 URL: https://github.com/kamailio/kamailio/commit/25099a1f9e3f3ebb5b3c19ca51e4d5c5fdc6a0c8
Author: eddie2072 <[email protected]> Committer: Richard Fuchs <[email protected]> Date: 2026-02-04T08:59:54-04:00 rtpengine: avoid use-after-free when logging duplicate hash entry (cherry picked from commit 94ce539038df5565e88bfa8105cfc289575105cd) --- Modified: src/modules/rtpengine/rtpengine_hash.c --- Diff: https://github.com/kamailio/kamailio/commit/25099a1f9e3f3ebb5b3c19ca51e4d5c5fdc6a0c8.diff Patch: https://github.com/kamailio/kamailio/commit/25099a1f9e3f3ebb5b3c19ca51e4d5c5fdc6a0c8.patch --- diff --git a/src/modules/rtpengine/rtpengine_hash.c b/src/modules/rtpengine/rtpengine_hash.c index 6aaead44e1f..ca2a8ee6c9d 100644 --- a/src/modules/rtpengine/rtpengine_hash.c +++ b/src/modules/rtpengine/rtpengine_hash.c @@ -184,10 +184,12 @@ int rtpengine_hash_table_insert( && STR_EQ(entry->viabranch, new_entry->viabranch)) { // unlock lock_release(&rtpengine_hash_table->row_locks[hash_index]); + + // entry may have been freed by a concurrent DELETE operation; + // use function parameters which are guaranteed to be valid LM_NOTICE("callid=%.*s, viabranch=%.*s already in hashtable, " "ignore new value\n", - entry->callid.len, entry->callid.s, entry->viabranch.len, - entry->viabranch.s); + callid.len, callid.s, viabranch.len, viabranch.s); return 0; } _______________________________________________ Kamailio - Development Mailing List -- [email protected] To unsubscribe send an email to [email protected] Important: keep the mailing list in the recipients, do not reply only to the sender!
