- free shm-cloned via lumps fix backported (see SER-55)

Makefile.defs

@@ -58,7 +58,7 @@ MAIN_NAME=ser
 VERSION = 0
 PATCHLEVEL = 9
 SUBLEVEL = 4
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
 
 RELEASE=$(VERSION).$(PATCHLEVEL).$(SUBLEVEL)$(EXTRAVERSION)
 OS = $(shell uname -s | sed -e s/SunOS/solaris/ | tr "[A-Z]" "[a-z]")

data_lump.c

@@ -372,9 +372,17 @@ struct lump* anchor_lump(struct sip_msg* msg, int offset, int len, int type)
 void free_lump(struct lump* lmp)
 {
 	if (lmp && (lmp->op==LUMP_ADD)){
-		if (lmp->u.value) pkg_free(lmp->u.value);
-		lmp->u.value=0;
-		lmp->len=0;
+		if (lmp->u.value){
+			if (lmp->flags &(LUMPFLAG_DUPED|LUMPFLAG_SHMEM)){
+				LOG(L_CRIT, "BUG: free_lump: called on a not free-able lump:"
+						"%p flags=%x\n", lmp, lmp->flags);
+				abort();
+			}else{
+				pkg_free(lmp->u.value);
+				lmp->u.value=0;
+				lmp->len=0;
+			}
+		}
 	}
 }
 

modules/tm/fix_lumps.h

@@ -35,6 +35,8 @@
  * -------
  *  2003-11-24  changed free_via_lump to free_via_clen_lump and make it
  *              handle CONTENTLENGTH lumps also (andrei)
+ *  2005-07-04  lumps in SHM or dup'ed lumps are not freed and an warning
+ *               message is logged (temporary fix) (andrei)
  */
 
 
@@ -67,21 +69,33 @@ inline static void free_via_clen_lump( struct lump **list )
 	for(lump=*list;lump;lump=next) {
 		next=lump->next;
 		if (lump->type==HDR_VIA||lump->type==HDR_CONTENTLENGTH) {
+			if (lump->flags & (LUMPFLAG_DUPED|LUMPFLAG_SHMEM)){
+				LOG(L_CRIT, "BUG: free_via_clen_lmp: lump %p, flags %x\n",
+						lump, lump->flags);
+				/* ty to continue */
+			}
 			a=lump->before;
 			while(a) {
 				foo=a; a=a->before;
-				free_lump(foo);
-				pkg_free(foo);
+				if (!(foo->flags&(LUMPFLAG_DUPED|LUMPFLAG_SHMEM)))
+					free_lump(foo);
+				if (!(foo->flags&LUMPFLAG_SHMEM))
+					pkg_free(foo);
 			}
 			a=lump->after;
 			while(a) {
 				foo=a; a=a->after;
-				free_lump(foo);
-				pkg_free(foo);
+				if (!(foo->flags&(LUMPFLAG_DUPED|LUMPFLAG_SHMEM)))
+					free_lump(foo);
+				if (!(foo->flags&LUMPFLAG_SHMEM))
+					pkg_free(foo);
 			}
 			if (prev_lump) prev_lump->next = lump->next;
 			else *list = lump->next;
-			free_lump(lump);pkg_free(lump);
+			if (!(lump->flags&(LUMPFLAG_DUPED|LUMPFLAG_SHMEM)))
+				free_lump(lump);
+			if (!(lump->flags&LUMPFLAG_SHMEM))
+				pkg_free(lump);
 		} else {
 			/* store previous position */
 			prev_lump=lump;

modules/tm/h_table.c

@@ -60,6 +60,7 @@
 #include "t_cancel.h"
 #include "t_stats.h"
 #include "h_table.h"
+#include "fix_lumps.h" /* free_via_clen_lump */
 
 static enum kill_reason kr;
 
@@ -255,6 +256,9 @@ struct cell*  build_cell( struct sip_msg* p_msg )
 		run_reqin_callbacks( new_cell, p_msg, p_msg->REQ_METHOD);
 
 	if (p_msg) {
+		/* clean possible previous added vias/clen header or else they would 
+		 * get propagated in the failure routes */
+		free_via_clen_lump(&p_msg->add_rm);
 		new_cell->uas.request = sip_msg_cloner(p_msg,&sip_msg_len);
 		if (!new_cell->uas.request)
 			goto error;