Module: kamailio
Branch: 5.8
Commit: 451ea2ac7968473e840e92f3e6c72d712d753040
URL: 
https://github.com/kamailio/kamailio/commit/451ea2ac7968473e840e92f3e6c72d712d753040

Author: eddie2072 <[email protected]>
Committer: Richard Fuchs <[email protected]>
Date: 2026-02-04T09:03:01-04:00

rtpengine: avoid use-after-free when logging duplicate hash entry

(cherry picked from commit 94ce539038df5565e88bfa8105cfc289575105cd)

---

Modified: src/modules/rtpengine/rtpengine_hash.c

---

Diff:  
https://github.com/kamailio/kamailio/commit/451ea2ac7968473e840e92f3e6c72d712d753040.diff
Patch: 
https://github.com/kamailio/kamailio/commit/451ea2ac7968473e840e92f3e6c72d712d753040.patch

---

diff --git a/src/modules/rtpengine/rtpengine_hash.c 
b/src/modules/rtpengine/rtpengine_hash.c
index de6dbc9d5ed..bb4038162fd 100644
--- a/src/modules/rtpengine/rtpengine_hash.c
+++ b/src/modules/rtpengine/rtpengine_hash.c
@@ -258,10 +258,12 @@ int rtpengine_hash_table_insert(
                                && str_equal(entry->viabranch, 
new_entry->viabranch)) {
                        // unlock
                        
lock_release(rtpengine_hash_table->row_locks[hash_index]);
+
+                       // entry may have been freed by a concurrent DELETE 
operation;
+                       // use function parameters which are guaranteed to be 
valid
                        LM_NOTICE("callid=%.*s, viabranch=%.*s already in 
hashtable, "
                                          "ignore new value\n",
-                                       entry->callid.len, entry->callid.s, 
entry->viabranch.len,
-                                       entry->viabranch.s);
+                                       callid.len, callid.s, viabranch.len, 
viabranch.s);
                        return 0;
                }
 

_______________________________________________
Kamailio - Development Mailing List -- [email protected]
To unsubscribe send an email to [email protected]
Important: keep the mailing list in the recipients, do not reply only to the 
sender!

Reply via email to