Merge branch 'master' into coverity_scan

modules/acc/acc_vars.c

@@ -402,13 +402,13 @@ int pv_get_acc_leg(struct sip_msg *msg, pv_param_t *param,
 	}
 
 	if (leg_idx < 0) {
-		if (ctx->legs_no + leg_idx < -1) {
+		if ((int)ctx->legs_no + leg_idx < 0) {
 			LM_ERR("invalid leg index %d!\n", leg_idx);
 			return -1;
 		}
 
 		/* -1 will be the last element and so on */
-		leg_idx += (ctx->legs_no + 1);
+		leg_idx += ctx->legs_no;
 	}
 
 	val->flags = PV_VAL_STR;
@@ -486,13 +486,13 @@ int pv_set_acc_leg(struct sip_msg *msg, pv_param_t *param, int flag,
 	}
 
 	if (leg_idx < 0) {
-		if ((int)ctx->legs_no + leg_idx < -1) {
+		if ((int)ctx->legs_no + leg_idx < 0) {
 			LM_ERR("invalid leg index %d!\n", leg_idx);
 			return -1;
 		}
 
-		/* -1 will be the last element  */
-		leg_idx = (int)ctx->legs_no + leg_idx;
+		/* -1 will be the last element and so on */
+		leg_idx += ctx->legs_no;
 	}
 
 	accX_lock(&ctx->lock);

modules/compression/compression.c

@@ -723,7 +723,7 @@ static int mc_compact_cb(char** buf_p, void* param, int type, int* olen)
 		hf = 0;
 	}
 
-	hdr_len = msg_total_len;
+	hdr_len = msg_total_len + CRLF_LEN/* sip headers end with 2 * CRLF */;
 
 	buf_cpy = buf+CRLF_LEN;
 	frg = frg_head = pkg_malloc(sizeof(body_frag_t));

modules/dialog/dlg_db_handler.c

@@ -496,7 +496,6 @@ static int load_dialog_info_from_db(int dlg_hash_size)
 	struct dlg_cell *dlg;
 	str callid, from_uri, to_uri, from_tag, to_tag;
 	str cseq1,cseq2,contact1,contact2,rroute1,rroute2,mangled_fu,mangled_tu;
-	unsigned int next_id;
 	int no_rows = 10;
 	struct socket_info *caller_sock,*callee_sock;
 	int found_ended_dlgs=0;
@@ -543,7 +542,7 @@ static int load_dialog_info_from_db(int dlg_hash_size)
 			caller_sock = create_socket_info(values, 15);
 			callee_sock = create_socket_info(values, 16);
 			if (caller_sock == NULL || callee_sock == NULL) {
-				LM_ERR("Dialog in DB doesn't match any listening sockets");
+				LM_ERR("Dialog in DB doesn't match any listening sockets\n");
 				continue;
 			}
 
@@ -573,10 +572,10 @@ static int load_dialog_info_from_db(int dlg_hash_size)
 			link_dlg(dlg, 0);
 
 			dlg->h_id = hash_id;
-			next_id = d_table->entries[dlg->h_entry].next_id;
 
-			d_table->entries[dlg->h_entry].next_id =
-				(next_id <= dlg->h_id) ? (dlg->h_id+1) : next_id;
+			/* next_id follows the max value of all loaded ids */
+			if (d_table->entries[dlg->h_entry].next_id <= dlg->h_id)
+				d_table->entries[dlg->h_entry].next_id = dlg->h_id + 1;
 
 			GET_STR_VALUE(to_tag, values, 5, 1, 1);
 
@@ -1491,7 +1490,7 @@ static int sync_dlg_db_mem(void)
 	db_row_t * rows;
 	struct dlg_entry *d_entry;
 	struct dlg_cell *it,*known_dlg,*dlg=NULL;
-	int i, nr_rows,callee_leg_idx,next_id,db_timeout;
+	int i, nr_rows,callee_leg_idx,db_timeout;
 	int no_rows = 10;
 	unsigned int db_caller_cseq = 0, db_callee_cseq = 0;
 	unsigned int dlg_caller_cseq = 0, dlg_callee_cseq = 0;
@@ -1597,10 +1596,10 @@ static int sync_dlg_db_mem(void)
 				link_dlg(dlg, 0);
 
 				dlg->h_id = hash_id;
-				next_id = d_table->entries[dlg->h_entry].next_id;
 
-				d_table->entries[dlg->h_entry].next_id =
-					(next_id <= dlg->h_id) ? (dlg->h_id+1) : next_id;
+				/* next_id follows the max value of all loaded ids */
+				if (d_table->entries[dlg->h_entry].next_id <= dlg->h_id)
+					d_table->entries[dlg->h_entry].next_id = dlg->h_id + 1;
 
 				dlg->start_ts	= VAL_INT(values+6);
 

modules/dialog/dlg_replication.c

@@ -84,7 +84,7 @@ static struct socket_info * fetch_socket_info(str *addr)
  */
 int dlg_replicated_create(struct dlg_cell *cell, str *ftag, str *ttag, int safe)
 {
-	int next_id, h_entry;
+	int h_entry;
 	unsigned int dir, dst_leg;
 	str callid, from_uri, to_uri, from_tag, to_tag;
 	str cseq1, cseq2, contact1, contact2, rroute1, rroute2, mangled_fu, mangled_tu;
@@ -140,10 +140,9 @@ int dlg_replicated_create(struct dlg_cell *cell, str *ftag, str *ttag, int safe)
 	bin_pop_int(&dlg->start_ts);
 	bin_pop_int(&dlg->state);
 
-	next_id = d_table->entries[dlg->h_entry].next_id;
-
-	d_table->entries[dlg->h_entry].next_id =
-		(next_id <= dlg->h_id) ? (dlg->h_id + 1) : next_id;
+	/* next_id follows the max value of all replicated ids */
+	if (d_table->entries[dlg->h_entry].next_id <= dlg->h_id)
+		d_table->entries[dlg->h_entry].next_id = dlg->h_id + 1;
 
 	if (bin_pop_str(&sock))
 		goto pre_linking_error;
@@ -182,7 +181,6 @@ int dlg_replicated_create(struct dlg_cell *cell, str *ftag, str *ttag, int safe)
 	dlg->legs_no[DLG_LEG_200OK] = DLG_FIRST_CALLEE_LEG;
 
 	/* link the dialog into the hash */
-	dlg->h_id = d_entry->next_id++;
 	if (!d_entry->first)
 		d_entry->first = d_entry->last = dlg;
 	else {

modules/dispatcher/dispatch.c

@@ -1358,7 +1358,7 @@ static inline int push_ds_2_avps( ds_dest_t *ds, ds_partition_t *partition )
 	char buf[PTR_STRING_SIZE]; /* a hexa string */
 	int_str avp_val;
 
-	avp_val.s.len = 1 + snprintf( buf, PTR_STR_SIZE, "%p", ds->sock );
+	avp_val.s.len = snprintf( buf, PTR_STR_SIZE, "%p", ds->sock );
 	avp_val.s.s = buf;
 	if(add_avp(AVP_VAL_STR| partition->sock_avp_type,
 				partition->sock_avp_name, avp_val)!=0) {
@@ -1661,13 +1661,7 @@ int ds_select_dst(struct sip_msg *msg, ds_select_ctl_p ds_select_ctl,
 		LM_ERR("cannot set selected_dst uri\n");
 		goto error;
 	}
-	if (selected->sock) {
-		selected_dst->socket.len = 1 +
-		snprintf( selected_dst->socket.s, PTR_STR_SIZE, "%p", selected->sock );
-	}
-	else {
-		selected_dst->socket.len = 0;
-	}
+	selected_dst->socket = selected->sock;
 
 	LM_DBG("selected [%d-%d/%d] <%.*s>\n",
 		ds_select_ctl->alg, ds_select_ctl->set, ds_id,

modules/dispatcher/dispatch.h

@@ -171,7 +171,7 @@ typedef struct
 typedef struct _ds_selected_dst
 {
 	str uri;
-	str socket;
+	struct socket_info *socket;
 } ds_selected_dst, *ds_selected_dst_p;
 
 extern str ds_set_id_col;

modules/dispatcher/dispatcher.c

@@ -972,9 +972,7 @@ static int w_ds_select(struct sip_msg* msg, char* part_set, char* alg,
 	int _ret;
 	int run_prev_ds_select = 0;
 	ds_select_ctl_t prev_ds_select_ctl, ds_select_ctl;
-	char selected_dst_sock_buf[PTR_STRING_SIZE]; /* a hexa string */
 	ds_selected_dst selected_dst;
-	struct socket_info *sock = NULL;
 
 	if(msg==NULL)
 		return -1;
@@ -986,7 +984,6 @@ static int w_ds_select(struct sip_msg* msg, char* part_set, char* alg,
 	ds_select_ctl.ds_flags = 0;
 
 	memset(&selected_dst, 0, sizeof(ds_selected_dst));
-	selected_dst.socket.s = selected_dst_sock_buf;
 
 	/* Retrieve dispatcher set */
 	ds_param_t *part_set_param = (ds_param_t*)part_set;
@@ -1107,15 +1104,8 @@ static int w_ds_select(struct sip_msg* msg, char* part_set, char* alg,
 	}
 	else {
 		if (selected_dst.uri.s != NULL) {
-			if (selected_dst.socket.len != 0) {
-				if (sscanf( selected_dst.socket.s, "%p", (void**)&sock ) != 1){
-					LM_ERR("unable to read forced destination socket\n");
-					ret = -4;
-					goto error;
-				}
-			}
-			if (ds_update_dst(msg, &selected_dst.uri, sock, ds_select_ctl.mode)
-			!= 0) {
+			if (ds_update_dst(msg, &selected_dst.uri, selected_dst.socket,
+			ds_select_ctl.mode) != 0) {
 				LM_ERR("cannot set dst addr\n");
 				ret = -3;
 				goto error;

modules/dns_cache/dns_cache.c

@@ -459,14 +459,14 @@ static char* serialize_dns_rdata(struct rdata *head,int buf_len,int *len,int do_
 	}
 
 	if (do_encoding) {
-		if (*len)
+		if (len)
 			*len = base64_len;
 
 		/* encode and return beggining of encoding */
 		base64encode(p,rdata_buf,buf_len);
 		return (char *)p;
 	} else {
-		if (*len)
+		if (len)
 			*len = needed_len;
 		return (char *)rdata_buf;
 	}

modules/drouting/routing.c

@@ -609,7 +609,6 @@ add_dst(
 	key.s = id;
 	key.len = strlen(id);
 
-	LM_INFO("pgw tree %p\n", r->pgw_tree);
 	if (map_put(r->pgw_tree, key, pgw)) {
 		LM_ERR("Duplicate gateway!\n");
 		return -1;

modules/emergency/sip_emergency.c

@@ -41,7 +41,6 @@ const char *LOCATION_TAG_BEGIN = "<location-key>";
 const char *LOCATION_TAG_END = "</location-key>";
 const char *NEW_LINE = "\n";
 
-const char *CONTENT_TYPE_PIDF = "Content-Type: application/pidf+xml";
 const char *PRESENCE_START = "<presence";
 const char *PRESENCE_END = "/presence>";
 
@@ -52,6 +51,9 @@ const char *EVENT_TYPE = "dialog";
 const char *CALLID_PARAM = "call-id=";
 const char *FROMTAG_PARAM = ";from-tag=";
 
+
+#define MIME_PIDF                "application/pidf+xml"
+#define MIME_PIDF_LEN            (sizeof(MIME_PIDF)-1)
 #define PAI_SUFFIX               ";user=phone;CBN="
 #define PAI_SUFFIX_LEN           (sizeof(PAI_SUFFIX)-1)
 #define PAI_SUFFIX_II            ";user=phone>\n"
@@ -897,10 +899,16 @@ int find_body_pidf(struct sip_msg *msg, char** pidf_body) {
 
 	mbody_part = &msg->body->first;
 	while (mbody_part != NULL) {
+
+		/* skip body parts which were deleted or newly added */
+		if (!is_body_part_received(mbody_part))
+			continue;
+
 		LM_DBG(" --- PIDF BODY %.*s", mbody_part->body.len, mbody_part->body.s);
 		LM_DBG(" --- PIDF BODY COUNT %d", ++cont);
 
-		if (strstr(mbody_part->body.s, CONTENT_TYPE_PIDF) != NULL) {
+		if ( mbody_part->mime_s.len==MIME_PIDF_LEN &&
+		memcmp(mbody_part->mime_s.s, MIME_PIDF, mbody_part->mime_s.len)==0 ) {
 			body_start = strstr(mbody_part->body.s, PRESENCE_START);
 			body_end = strstr(mbody_part->body.s, PRESENCE_END);
 			size_body = body_end - body_start + 11;

modules/fraud_detection/fraud_detection.c

@@ -273,10 +273,10 @@ static int check_fraud(struct sip_msg *msg, char *_user, char *_number, char *_p
 	static str last_called_prefix;
 	extern unsigned int frd_data_rev;
 
-	if (dr_head == NULL) {
+	if (*dr_head == NULL) {
 		/* No data, probably still loading */
-		LM_ERR("no data\n");
-		return rc_error;
+		LM_INFO("rules are not available yet!\n");
+		return rc_ok_thr;
 	}
 
 	/* Get the actual params */

modules/nathelper/nathelper.c

@@ -819,6 +819,10 @@ sdp_1918(struct sip_msg* msg)
 
 	for ( p=&msg->body->first ; p ; p=p->next) {
 
+		/* skip body parts which were deleted or newly added */
+		if (!is_body_part_received(p))
+			continue;
+
 		body = p->body;
 		trim_r(body);
 
@@ -1162,6 +1166,10 @@ fix_nated_sdp_f(struct sip_msg* msg, char* str1, char* str2)
 
 	for ( p=&msg->body->first ; p ; p=p->next )
 	{
+		/* skip body parts which were deleted or newly added */
+		if (!is_body_part_received(p))
+			continue;
+
 		body = p->body;
 		trim_r(body);
 		if( p->mime != ((TYPE_APPLICATION << 16) + SUBTYPE_SDP)

modules/proto_hep/proto_hep.c

@@ -859,7 +859,7 @@ static inline int hep_handle_req(struct tcp_req *req,
 
 	int ret=0;
 
-	struct hep_context *hep_ctx;
+	struct hep_context *hep_ctx=NULL;
 	context_p ctx=NULL;
 
 	if (req->complete){
@@ -941,7 +941,8 @@ static inline int hep_handle_req(struct tcp_req *req,
 				receive_msg(msg_buf, msg_len, &local_rcv, ctx) <0)
 				LM_ERR("receive_msg failed \n");
 
-		free_hep_context(hep_ctx);
+		if (hep_ctx)
+			free_hep_context(hep_ctx);
 
 		if (!size && req != &hep_current_req) {
 			/* if we no longer need this tcp_req

modules/rtpengine/rtpengine.c

@@ -321,7 +321,8 @@ int msg_has_sdp(struct sip_msg *msg)
 	}
 
 	for (p = &msg->body->first; p; p = p->next) {
-		if (p->mime == ((TYPE_APPLICATION << 16) + SUBTYPE_SDP))
+		if ( is_body_part_received(p) &&
+		p->mime == ((TYPE_APPLICATION << 16) + SUBTYPE_SDP) )
 			return 1;
 	}
 

modules/rtpengine/rtpengine_funcs.c

@@ -171,6 +171,10 @@ int extract_body(struct sip_msg *msg, str *body )
 
 	for ( p=&msg->body->first ; p ; p=p->next )
 	{
+		/* skip body parts which were deleted or newly added */
+		if (!is_body_part_received(p))
+			continue;
+
 		*body = p->body;
 		trim_r(*body);
 		if( p->mime != ((TYPE_APPLICATION << 16) + SUBTYPE_SDP)