- current processed reply made available in failure route

- reinforce the checking on transaction destroy to avoid mixture
  between SHM and PKG uac replies (this can happend only on shutdown)

modules/tm/h_table.c

@@ -145,7 +145,7 @@ void free_cell( struct cell* dead_cell )
 		if (b!=0 && b!=BUSY_BUFFER)
 			shm_free_unsafe( b );
 		rpl=dead_cell->uac[i].reply;
-		if (rpl && rpl!=FAKED_REPLY) {
+		if (rpl && rpl!=FAKED_REPLY && rpl->msg_flags&FL_SHM_CLONE) {
 			sip_msg_free_unsafe( rpl );
 		}
 	}

modules/tm/sip_msg.c

@@ -404,6 +404,7 @@ do { \
 	new_msg = (struct sip_msg*)p;
 	/* sip msg structure */
 	memcpy( new_msg , org_msg , sizeof(struct sip_msg) );
+	new_msg->msg_flags |= FL_SHM_CLONE;
 	p += ROUND4(sizeof(struct sip_msg));
 	new_msg->add_rm = 0;
 	new_msg->body_lumps = 0;

modules/tm/t_reply.c

@@ -761,15 +761,24 @@ static enum rps t_should_relay_response( struct cell *Trans , int new_code,
 		   a callback; save branch count to be able to determine
 		   later if new branches were initiated */
 		branch_cnt=Trans->nr_of_outgoings;
+		/* also append the current reply to the transaction to 
+		 * make it available in failure routes - a kind of "fake"
+		 * save of the final reply per branch */
+		Trans->uac[branch].reply = reply;
 
 		/* run ON_FAILURE handlers ( route and callbacks) */
 		if ( has_tran_tmcbs( Trans, TMCB_ON_FAILURE_RO|TMCB_ON_FAILURE)
 		|| Trans->on_negative ) {
 			run_failure_handlers( Trans,
-				picked_branch==branch?reply:Trans->uac[picked_branch].reply, 
+				Trans->uac[picked_branch].reply,
 				picked_code);
 		}
 
+		/* now reset it; after the failure logic, the reply may
+		 * not be stored any more and we don't want to keep into
+		 * transaction some broken reference */
+		Trans->uac[branch].reply = 0;
+
 		/* look if the callback perhaps replied transaction; it also
 		   covers the case in which a transaction is replied localy
 		   on CANCEL -- then it would make no sense to proceed to

parser/msg_parser.h

@@ -72,6 +72,7 @@ enum request_method { METHOD_UNDEF=0, METHOD_INVITE=1, METHOD_CANCEL=2, METHOD_A
 #define FL_FORCE_ACTIVE 2  /* force active SDP */
 #define FL_SDP_IP_AFS 4    /* SDP IP rewritten */
 #define FL_SDP_PORT_AFS 8  /* SDP port rewritten */
+#define FL_SHM_CLONE   16  /* msg cloned in SHM as a single chunk */
 
 
 #define IFISMETHOD(methodname,firstchar)                                  \