[sr-dev] git:master:09218156: tm: prevent t_suspend memory leak (#2763)

[GitHub]

Content preview: Module: kamailio Branch: master Commit: 09218156f3831ec9642d9ebf20d8668229ab16d6
URL: https://github.com/kamailio/kamailio/commit/09218156f3831ec9642d9ebf20d8668229ab16d6
Author: Julien Chavanton <***@gmail.com> Committer: GitHub <***@github.com>
Date: 2021-06-07T08:13:36-07:00

Content analysis details: (-3.7 points, 5.5 required)

pts rule name description
---- ---------------------- --------------------------------------------------
-1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP
-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
[score: 0.0000]
0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list
manager

Module: kamailio
Branch: master
Commit: 09218156f3831ec9642d9ebf20d8668229ab16d6
URL: https://github.com/kamailio/kamailio/commit/09218156f3831ec9642d9ebf20d8668229ab16d6

Author: Julien Chavanton <***@gmail.com>
Committer: GitHub <***@github.com>
Date: 2021-06-07T08:13:36-07:00

tm: prevent t_suspend memory leak (#2763)

When suspending while already in t_continue when processing a reply / suspending twice in a reply.

Co-authored-by: Julien Chavanton <***@subspace.com>

---

Modified: src/modules/tm/t_suspend.c

---

Diff: https://github.com/kamailio/kamailio/commit/09218156f3831ec9642d9ebf20d8668229ab16d6.diff
Patch: https://github.com/kamailio/kamailio/commit/09218156f3831ec9642d9ebf20d8668229ab16d6.patch

---

diff --git a/src/modules/tm/t_suspend.c b/src/modules/tm/t_suspend.c
index 04f906f53c..826307d20a 100644
--- a/src/modules/tm/t_suspend.c
+++ b/src/modules/tm/t_suspend.c
@@ -118,18 +118,23 @@ int t_suspend(struct sip_msg *msg,
LM_ERR("failed find UAC branch\n");
return -1;
}
- LM_DBG("found a a match with branch id [%d] - "
- "cloning reply message to t->uac[branch].reply\n", branch);

- sip_msg_len = 0;
- t->uac[branch].reply = sip_msg_cloner( msg, &sip_msg_len );
+ if (!t->uac[branch].reply) {
+ sip_msg_len = 0;
+ LM_DBG("found a match with branch id [%d] - "
+ "cloning reply message to t->uac[branch].reply\n", branch);
+ t->uac[branch].reply = sip_msg_cloner( msg, &sip_msg_len );

- if (! t->uac[branch].reply ) {
- LM_ERR("can't alloc' clone memory\n");
- return -1;
+ if (! t->uac[branch].reply ) {
+ LM_ERR("can't alloc' clone memory\n");
+ return -1;
+ }
+ t->uac[branch].end_reply = ((char*)t->uac[branch].reply) + sip_msg_len;
+ } else {
+ LM_DBG("found a match with branch id [%d] - "
+ "message already cloned to t->uac[branch].reply\n", branch);
+ // This can happen when suspending more than once in a reply.
}
- t->uac[branch].end_reply = ((char*)t->uac[branch].reply) + sip_msg_len;
-
LM_DBG("saving transaction data\n");
t->uac[branch].reply->flags = msg->flags;
t->flags |= T_ASYNC_SUSPENDED;