Module: kamailio
Branch: 6.1
Commit: 25099a1f9e3f3ebb5b3c19ca51e4d5c5fdc6a0c8
URL: 
https://github.com/kamailio/kamailio/commit/25099a1f9e3f3ebb5b3c19ca51e4d5c5fdc6a0c8

Author: eddie2072 <[email protected]>
Committer: Richard Fuchs <[email protected]>
Date: 2026-02-04T08:59:54-04:00

rtpengine: avoid use-after-free when logging duplicate hash entry

(cherry picked from commit 94ce539038df5565e88bfa8105cfc289575105cd)

---

Modified: src/modules/rtpengine/rtpengine_hash.c

---

Diff:  
https://github.com/kamailio/kamailio/commit/25099a1f9e3f3ebb5b3c19ca51e4d5c5fdc6a0c8.diff
Patch: 
https://github.com/kamailio/kamailio/commit/25099a1f9e3f3ebb5b3c19ca51e4d5c5fdc6a0c8.patch

---

diff --git a/src/modules/rtpengine/rtpengine_hash.c 
b/src/modules/rtpengine/rtpengine_hash.c
index 6aaead44e1f..ca2a8ee6c9d 100644
--- a/src/modules/rtpengine/rtpengine_hash.c
+++ b/src/modules/rtpengine/rtpengine_hash.c
@@ -184,10 +184,12 @@ int rtpengine_hash_table_insert(
                                && STR_EQ(entry->viabranch, 
new_entry->viabranch)) {
                        // unlock
                        
lock_release(&rtpengine_hash_table->row_locks[hash_index]);
+
+                       // entry may have been freed by a concurrent DELETE 
operation;
+                       // use function parameters which are guaranteed to be 
valid
                        LM_NOTICE("callid=%.*s, viabranch=%.*s already in 
hashtable, "
                                          "ignore new value\n",
-                                       entry->callid.len, entry->callid.s, 
entry->viabranch.len,
-                                       entry->viabranch.s);
+                                       callid.len, callid.s, viabranch.len, 
viabranch.s);
                        return 0;
                }
 

_______________________________________________
Kamailio - Development Mailing List -- [email protected]
To unsubscribe send an email to [email protected]
Important: keep the mailing list in the recipients, do not reply only to the 
sender!

Reply via email to