Module: kamailio Branch: 6.0 Commit: 4fe55009757be0de60bffe647eef9a8cc1257d0b URL: https://github.com/kamailio/kamailio/commit/4fe55009757be0de60bffe647eef9a8cc1257d0b
Author: eddie2072 <[email protected]> Committer: Richard Fuchs <[email protected]> Date: 2026-02-04T09:00:48-04:00 rtpengine: avoid use-after-free when logging duplicate hash entry (cherry picked from commit 94ce539038df5565e88bfa8105cfc289575105cd) --- Modified: src/modules/rtpengine/rtpengine_hash.c --- Diff: https://github.com/kamailio/kamailio/commit/4fe55009757be0de60bffe647eef9a8cc1257d0b.diff Patch: https://github.com/kamailio/kamailio/commit/4fe55009757be0de60bffe647eef9a8cc1257d0b.patch --- diff --git a/src/modules/rtpengine/rtpengine_hash.c b/src/modules/rtpengine/rtpengine_hash.c index 2c7f8f2f0ba..5e5970d9abb 100644 --- a/src/modules/rtpengine/rtpengine_hash.c +++ b/src/modules/rtpengine/rtpengine_hash.c @@ -240,10 +240,12 @@ int rtpengine_hash_table_insert( && STR_EQ(entry->viabranch, new_entry->viabranch)) { // unlock lock_release(rtpengine_hash_table->row_locks[hash_index]); + + // entry may have been freed by a concurrent DELETE operation; + // use function parameters which are guaranteed to be valid LM_NOTICE("callid=%.*s, viabranch=%.*s already in hashtable, " "ignore new value\n", - entry->callid.len, entry->callid.s, entry->viabranch.len, - entry->viabranch.s); + callid.len, callid.s, viabranch.len, viabranch.s); return 0; } _______________________________________________ Kamailio - Development Mailing List -- [email protected] To unsubscribe send an email to [email protected] Important: keep the mailing list in the recipients, do not reply only to the sender!
