Module: kamailio Branch: 5.8 Commit: 451ea2ac7968473e840e92f3e6c72d712d753040 URL: https://github.com/kamailio/kamailio/commit/451ea2ac7968473e840e92f3e6c72d712d753040
Author: eddie2072 <[email protected]> Committer: Richard Fuchs <[email protected]> Date: 2026-02-04T09:03:01-04:00 rtpengine: avoid use-after-free when logging duplicate hash entry (cherry picked from commit 94ce539038df5565e88bfa8105cfc289575105cd) --- Modified: src/modules/rtpengine/rtpengine_hash.c --- Diff: https://github.com/kamailio/kamailio/commit/451ea2ac7968473e840e92f3e6c72d712d753040.diff Patch: https://github.com/kamailio/kamailio/commit/451ea2ac7968473e840e92f3e6c72d712d753040.patch --- diff --git a/src/modules/rtpengine/rtpengine_hash.c b/src/modules/rtpengine/rtpengine_hash.c index de6dbc9d5ed..bb4038162fd 100644 --- a/src/modules/rtpengine/rtpengine_hash.c +++ b/src/modules/rtpengine/rtpengine_hash.c @@ -258,10 +258,12 @@ int rtpengine_hash_table_insert( && str_equal(entry->viabranch, new_entry->viabranch)) { // unlock lock_release(rtpengine_hash_table->row_locks[hash_index]); + + // entry may have been freed by a concurrent DELETE operation; + // use function parameters which are guaranteed to be valid LM_NOTICE("callid=%.*s, viabranch=%.*s already in hashtable, " "ignore new value\n", - entry->callid.len, entry->callid.s, entry->viabranch.len, - entry->viabranch.s); + callid.len, callid.s, viabranch.len, viabranch.s); return 0; } _______________________________________________ Kamailio - Development Mailing List -- [email protected] To unsubscribe send an email to [email protected] Important: keep the mailing list in the recipients, do not reply only to the sender!
