- applied dst_uri clone patch from Phil D'Amore. Fixes: msg->dst_uri not

being cloned (see SER-53).

modules/tm/sip_msg.c

@@ -294,6 +294,9 @@ struct sip_msg*  sip_msg_cloner( struct sip_msg *org_msg, int *sip_msg_len )
 	/*the new uri (if any)*/
 	if (org_msg->new_uri.s && org_msg->new_uri.len)
 		len+= ROUND4(org_msg->new_uri.len);
+	/*the dst uri (if any)*/
+	if (org_msg->dst_uri.s && org_msg->dst_uri.len)
+		len+= ROUND4(org_msg->dst_uri.len);
 	/*all the headers*/
 	for( hdr=org_msg->headers ; hdr ; hdr=hdr->next )
 	{
@@ -427,6 +430,13 @@ do { \
 		memcpy( p , org_msg->new_uri.s , org_msg->new_uri.len);
 		p += ROUND4(org_msg->new_uri.len);
 	}
+	/* dst_uri */
+	if (org_msg->dst_uri.s && org_msg->dst_uri.len)
+	{
+		new_msg->dst_uri.s = p;
+		memcpy( p , org_msg->dst_uri.s , org_msg->dst_uri.len);
+		p += ROUND4(org_msg->dst_uri.len);
+	}
 	/* message buffers(org and scratch pad) */
 	memcpy( p , org_msg->buf, org_msg->len);
 	/* ZT to be safer */

modules/tm/t_reply.c

@@ -554,6 +554,18 @@ static inline int fake_req(struct sip_msg *faked_req,
 			faked_req->new_uri.len);
 		faked_req->new_uri.s[faked_req->new_uri.len]=0;
 	}
+	/* dst_uri can change ALSO!!! -- make a private copy */
+	if (shmem_msg->dst_uri.s!=0 && shmem_msg->dst_uri.len!=0) {
+		faked_req->dst_uri.s=pkg_malloc(shmem_msg->dst_uri.len+1);
+		if (!faked_req->dst_uri.s) {
+			LOG(L_ERR, "ERROR: fake_req: no uri/pkg mem\n");
+			goto error00;
+		}
+		faked_req->dst_uri.len=shmem_msg->dst_uri.len;
+		memcpy( faked_req->dst_uri.s, shmem_msg->dst_uri.s, 
+			faked_req->dst_uri.len);
+		faked_req->dst_uri.s[faked_req->dst_uri.len]=0;
+	}
 
 	return 1;
 error00:
@@ -569,6 +581,11 @@ void inline static free_faked_req(struct sip_msg *faked_req, struct cell *t)
 		faked_req->new_uri.s = 0;
 	}
 
+	if (faked_req->dst_uri.s) {
+		pkg_free(faked_req->dst_uri.s);
+		faked_req->dst_uri.s = 0;
+	}
+
 	/* free all types of lump that were added in failure handlers */
 	del_nonshm_lump( &(faked_req->add_rm) );
 	del_nonshm_lump( &(faked_req->body_lumps) );