acc: clear new parsed headers when evaluating acc attributes

- the structures are in pkg, while request is taken from shm clone, can
  cause reference to the space of another process
- reported by Igor Potjevlesch

modules/acc/acc_logic.c

@@ -489,6 +489,7 @@ static inline void acc_onreply( struct cell* t, struct sip_msg *req,
 {
 	str new_uri_bk;
 	int br = -1;
+	hdr_field_t *hdr;
 
 	/* acc_onreply is bound to TMCB_REPLY which may be called
 	   from _reply, like when FR hits; we should not miss this
@@ -551,6 +552,19 @@ static inline void acc_onreply( struct cell* t, struct sip_msg *req,
 		req->new_uri = new_uri_bk;
 		req->parsed_uri_ok = 0;
 	}
+
+	/* free header's parsed structures that were added by resolving acc attributes */
+	for( hdr=req->headers ; hdr ; hdr=hdr->next ) {
+		if ( hdr->parsed && hdr_allocs_parse(hdr) &&
+		(hdr->parsed<(void*)t->uas.request ||
+		hdr->parsed>=(void*)t->uas.end_request)) {
+			/* header parsed filed doesn't point inside uas.request memory
+			 * chunck -> it was added by resolving acc attributes -> free it as pkg */
+			DBG("removing hdr->parsed %d\n", hdr->type);
+			clean_hdr_field(hdr);
+			hdr->parsed = 0;
+		}
+	}
 }