the famous bug fixed!

Makefile

@@ -40,7 +40,7 @@ NAME=ser
 #                  twice, trying to free a pointer alloc'ed with a different
 #                  malloc etc.)
 DEFS=-DTHREAD -DNOCR -DMACROEATER -DDNS_IP_HACK  -DSHM_MEM \
-	 -DPKG_MALLOC -DDBG_QM_MALLOC#-DNO_DEBUG
+	 -DPKG_MALLOC #-DDBG_QM_MALLOC -DNO_DEBUG
 # -DUSE_SHM_MEM
 #-DNO_DEBUG 
 #-DPKG_MALLOC

modules/tm/sip_msg.c

@@ -49,41 +49,37 @@ struct sip_msg* sip_msg_cloner( struct sip_msg *org_msg )
 	new_msg->first_line.u.reply.reason.s =  translate_pointer( new_msg->buf , org_msg->buf , org_msg->first_line.u.reply.reason.s );
     }
 
-    /* via1 (via_body* type) */
-    if (org_msg->via1)
-         new_msg->via1 = via_body_cloner( new_msg->buf , org_msg->buf , org_msg->via1 );
-
-    /* via2 (via_body* type) */
-    if (org_msg->via2)
-    {
-        if (org_msg->via1 && org_msg->via1->next )
-            new_msg->via2 = new_msg->via1->next;
-        else
-            new_msg->via2 = via_body_cloner( new_msg->buf , org_msg->buf , org_msg->via2 );
-    }
-
     /* all the headers */
-    new_msg->h_via1=0;
-    new_msg->h_via2=0;
-    for( header = org_msg->headers , last_hdr=0  ;  header;header=header->next)
+    new_msg->via1=0;
+    new_msg->via2=0;
+    for( header = org_msg->headers , last_hdr=0  ;  header ; header=header->next)
     {
 	switch ( header->type )
 	{
-	    case HDR_VIA1 :
+	    case HDR_VIA :
 		new_hdr = header_cloner( new_msg , org_msg , header );
-		new_hdr->parsed  = (void*)new_msg->via1;
-		if (new_msg->h_via1==0)
+		if ( !new_msg->via1 )
+		{
 		    new_msg->h_via1 = new_hdr;
-		else if(new_msg->h_via2==0)
-		    new_msg->h_via2 = new_hdr;
-		break;
-	    case HDR_CALLID :
-		new_hdr = header_cloner( new_msg , org_msg , header );
-		new_msg->callid = new_hdr;
-		break;
-	    case HDR_TO :
-		new_hdr = header_cloner( new_msg , org_msg , header );
-		new_msg->to = new_hdr;
+		    new_msg->via1 = via_body_cloner( new_msg->buf , org_msg->buf , (struct via_body*)header->parsed );
+		    new_hdr->parsed  = (void*)new_msg->via1;
+		     if ( new_msg->via1->next )
+		        new_msg->via2 = new_msg->via1->next;
+		}
+		else if ( !new_msg->via2 && new_msg->via1 )
+		{
+		     new_msg->h_via2 = new_hdr;
+		     if ( new_msg->via1->next )
+		        new_hdr->parsed = (void*)new_msg->via1->next;
+		     else{
+		        new_msg->via2 = via_body_cloner( new_msg->buf , org_msg->buf , (struct via_body*)header->parsed );
+		        new_hdr->parsed  = (void*)new_msg->via2;
+		     }
+		}
+		else if ( new_msg->via2 && new_msg->via1 )
+		{
+		    new_hdr->parsed  = new_msg->via1 = via_body_cloner( new_msg->buf , org_msg->buf , (struct via_body*)header->parsed );
+		}
 		break;
 	    case HDR_FROM :
 		new_hdr = header_cloner( new_msg , org_msg , header );
@@ -100,6 +96,10 @@ struct sip_msg* sip_msg_cloner( struct sip_msg *org_msg )
 		}
 		new_msg->cseq = new_hdr;
 		break;
+	    case HDR_CALLID :
+		new_hdr = header_cloner( new_msg , org_msg , header );
+		new_msg->callid = new_hdr;
+		break;
 	    case HDR_CONTACT :
 		new_hdr = header_cloner( new_msg , org_msg , header );
 		new_msg->contact = new_hdr;
@@ -173,7 +173,7 @@ struct via_body* via_body_cloner( char* new_buf , char *org_buf , struct via_bod
     if ( new_via->param_lst )
     {
        struct via_param *vp, *new_vp, *last_new_vp;
-       for( vp=new_via->param_lst, last_new_vp=0 ; vp ; vp=vp->next )
+       for( vp=org_via->param_lst, last_new_vp=0 ; vp ; vp=vp->next )
        {
           new_vp = (struct via_param*)sh_malloc(sizeof(struct via_param));
           memcpy( new_vp , vp , sizeof(struct via_param));
@@ -183,7 +183,7 @@ struct via_body* via_body_cloner( char* new_buf , char *org_buf , struct via_bod
           if (new_vp->type==PARAM_BRANCH)
              new_via->branch = new_vp;
 
-        if (last_new_vp)
+          if (last_new_vp)
              last_new_vp->next = new_vp;
           else
              new_via->param_lst = new_vp;
@@ -193,7 +193,8 @@ struct via_body* via_body_cloner( char* new_buf , char *org_buf , struct via_bod
        new_via->last_param = new_vp;
     }
 
-    if ( new_via->next )
+
+    if ( org_via->next )
         new_via->next = via_body_cloner( new_buf , org_buf , org_via->next );
 
    return new_via;
@@ -334,15 +335,12 @@ void sh_clean_hdr_field(struct hdr_field* hf)
       switch(hf->type)
       {
          case HDR_VIA:
-   DBG("DEBUG: sh_clean_hdr_field: sip_msg_free : via headers\n");
                sh_free_via_list(hf->parsed);
              break;
          case HDR_CSEQ:
-   DBG("DEBUG: sh_clean_hdr_field : cseq headers\n");
                 sh_free(hf->parsed);
              break;
          default:
-   DBG("DEBUG: sh_clean_hdr_field : unknown headers\n");
       }
    }
 }
@@ -357,7 +355,6 @@ void sh_free_hdr_field_lst(struct hdr_field* hf)
 
    while(hf)
     {
-      DBG("DEBUG: free_hdr_field_lst : %s [%d] (adr=%x)\n",hf->name.s, hf->type,hf);
        foo=hf;
        hf=hf->next;
        sh_clean_hdr_field(foo);
@@ -373,7 +370,6 @@ void sip_msg_free(struct sip_msg* msg)
    if (!msg) return;
 
    DBG("DEBUG: sip_msg_free : start\n");
-   //return;
 
    if (msg->new_uri.s)
    {
@@ -389,4 +385,5 @@ void sip_msg_free(struct sip_msg* msg)
    if (msg->orig) sh_free( msg->orig );
    if (msg->buf) sh_free( msg->buf );
 
+   DBG("DEBUG: sip_msg_free : done\n");
 }

modules/tm/t_funcs.c

@@ -133,10 +133,9 @@ int t_lookup_request( struct sip_msg* p_msg, char* foo, char* bar  )
    }
    /* start searching into the table */
    hash_index = hash( p_msg->callid->body , get_cseq(p_msg)->number ) ;
-   DBG("hash_index=%d\n", hash_index);
    if ( p_msg->first_line.u.request.method_value==METHOD_ACK  )
       isACK = 1;
-   DBG("t_lookup_request: 1.continue searching\n");
+   DBG("t_lookup_request: continue searching;  hash=%d, isACK=5d\n",hash_index,isACK);
 
    /* all the transactions from the entry are compared */
    p_cell     = hash_table->entrys[hash_index].first_cell;
@@ -908,6 +907,7 @@ int push_reply_from_uac_to_uas( struct cell* trans , unsigned int branch )
    char *buf;
    unsigned int len;
 
+   DBG("DEBUG: push_reply_from_uac_to_uas: start\n");
    /* if there is a reply, release the buffer (everything else stays same) */
    if ( trans->outbound_response )
    {
@@ -957,7 +957,7 @@ int push_reply_from_uac_to_uas( struct cell* trans , unsigned int branch )
    t_update_timers_after_sending_reply( T->outbound_response );
 
    /*send the reply*/
-   t_retransmit_reply( trans->inbound_request, 0 , 0 );
+   t_retransmit_reply( trans->inbound_response[branch], 0 , 0 );
 
    return 1;
 }

q_malloc.c

@@ -170,6 +170,7 @@ void* qm_malloc(struct qm_block* qm, unsigned int size)
 			f->file=file;
 			f->func=func;
 			f->line=line;
+	DBG("qm_malloc(%x, %d) returns address %x\n", qm, size,(char*)f+sizeof(struct qm_frag) );
 #endif
 			return (char*)f+sizeof(struct qm_frag);
 		}