diff --git a/modules/tm/h_table.c b/modules/tm/h_table.c
index 11eea2f87c5..2194569754e 100644
--- a/modules/tm/h_table.c
+++ b/modules/tm/h_table.c
@@ -115,17 +115,6 @@ unsigned int transaction_count( void )
 }
 
 
-/* TODO: replace these macros with a more generic approach --liviu */
-#ifdef HP_MALLOC
-	#define __sip_msg_free sip_msg_free
-	#define __shm_free shm_free
-	#define __destroy_avp_list destroy_avp_list
-#else
-	#define __sip_msg_free sip_msg_free_unsafe
-	#define __shm_free shm_free_unsafe
-	#define __destroy_avp_list destroy_avp_list_unsafe
-#endif
-
 void free_cell( struct cell* dead_cell )
 {
 	char *b;
@@ -141,48 +130,46 @@ void free_cell( struct cell* dead_cell )
 
 	release_cell_lock( dead_cell );
 
-#ifndef HP_MALLOC
-	shm_lock();
-#endif
+	tm_shm_lock();
 
 	/* UA Server */
 	if ( dead_cell->uas.request )
-		__sip_msg_free( dead_cell->uas.request );
+		free_cloned_msg_unsafe( dead_cell->uas.request );
 
 	if ( dead_cell->uas.response.buffer.s )
-		__shm_free( dead_cell->uas.response.buffer.s );
+		tm_shm_free_unsafe( dead_cell->uas.response.buffer.s );
 
 	/* UA Clients */
 	for ( i =0 ; i<dead_cell->nr_of_outgoings;  i++ )
 	{
 		/* retransmission buffer */
 		if ( (b=dead_cell->uac[i].request.buffer.s) )
-			__shm_free( b );
+			tm_shm_free_unsafe( b );
 		b=dead_cell->uac[i].local_cancel.buffer.s;
 		if (b!=0 && b!=BUSY_BUFFER)
-			__shm_free( b );
+			tm_shm_free_unsafe( b );
 		rpl=dead_cell->uac[i].reply;
 		if (rpl && rpl!=FAKED_REPLY && rpl->msg_flags&FL_SHM_CLONE) {
-			__sip_msg_free( rpl );
+			free_cloned_msg_unsafe( rpl );
 		}
 		if ( (p=dead_cell->uac[i].proxy)!=NULL ) {
 			if ( p->host.h_addr_list )
-				__shm_free( p->host.h_addr_list );
+				tm_shm_free_unsafe( p->host.h_addr_list );
 			if ( p->dn ) {
 				if ( p->dn->kids )
-					__shm_free( p->dn->kids );
-				__shm_free( p->dn );
+					tm_shm_free_unsafe( p->dn->kids );
+				tm_shm_free_unsafe( p->dn );
 			}
-			__shm_free(p);
+			tm_shm_free_unsafe(p);
 		}
 		if (dead_cell->uac[i].path_vec.s) {
-			__shm_free(dead_cell->uac[i].path_vec.s);
+			tm_shm_free_unsafe(dead_cell->uac[i].path_vec.s);
 		}
 		if (dead_cell->uac[i].duri.s) {
-			__shm_free(dead_cell->uac[i].duri.s);
+			tm_shm_free_unsafe(dead_cell->uac[i].duri.s);
 		}
 		if (dead_cell->uac[i].user_avps) {
-			__destroy_avp_list( &dead_cell->uac[i].user_avps);
+			tm_destroy_avp_list_unsafe( &dead_cell->uac[i].user_avps);
 		}
 	}
 
@@ -190,25 +177,23 @@ void free_cell( struct cell* dead_cell )
 	tt=dead_cell->fwded_totags;
 	while(tt) {
 		foo=tt->next;
-		__shm_free(tt->tag.s);
-		__shm_free(tt);
+		tm_shm_free_unsafe(tt->tag.s);
+		tm_shm_free_unsafe(tt);
 		tt=foo;
 	}
 
 	/* free the avp list */
 	if (dead_cell->user_avps)
-		__destroy_avp_list( &dead_cell->user_avps );
+		tm_destroy_avp_list_unsafe( &dead_cell->user_avps );
 
 	/* extra hdrs */
 	if ( dead_cell->extra_hdrs.s )
-		__shm_free( dead_cell->extra_hdrs.s );
+		tm_shm_free_unsafe( dead_cell->extra_hdrs.s );
 
 	/* the cell's body */
-	__shm_free( dead_cell );
+	tm_shm_free_unsafe( dead_cell );
 
-#ifndef HP_MALLOC
-	shm_unlock();
-#endif
+	tm_shm_unlock();
 }
 
 
@@ -327,7 +312,7 @@ struct cell*  build_cell( struct sip_msg* p_msg )
 		/* clean possible previous added vias/clen header or else they would
 		 * get propagated in the failure routes */
 		free_via_clen_lump(&p_msg->add_rm);
-		new_cell->uas.request = sip_msg_cloner(p_msg,&sip_msg_len);
+		new_cell->uas.request = sip_msg_cloner(p_msg,&sip_msg_len,1);
 		if (!new_cell->uas.request)
 			goto error;
 		new_cell->uas.end_request=((char*)new_cell->uas.request)+sip_msg_len;
diff --git a/modules/tm/sip_msg.c b/modules/tm/sip_msg.c
index b298d622354..3cbc5b2feca 100644
--- a/modules/tm/sip_msg.c
+++ b/modules/tm/sip_msg.c
@@ -63,6 +63,7 @@
 #define lump_len( _lump) \
 	(ROUND4(sizeof(struct lump)) +\
 	ROUND4(((_lump)->op==LUMP_ADD)?(_lump)->len:0))
+
 #define lump_clone( _new,_old,_ptr) \
 	{\
 		(_new) = (struct lump*)(_ptr);\
@@ -307,9 +308,94 @@ static inline int clone_authorized_hooks(struct sip_msg* new,
 	} while(0)
 
 
-struct sip_msg*  sip_msg_cloner( struct sip_msg *org_msg, int *sip_msg_len )
+#define LUMP_LIST_LEN(_len, list) \
+do { \
+	struct lump* tmp, *chain; \
+	chain = (list); \
+	while (chain) \
+	{ \
+		(_len) += lump_len(chain); \
+		tmp = chain->before; \
+		while ( tmp ) \
+		{ \
+			(_len) += lump_len( tmp ); \
+			tmp = tmp->before; \
+		} \
+		tmp = chain->after; \
+		while ( tmp ) \
+		{ \
+			(_len) += lump_len( tmp ); \
+			tmp = tmp->after; \
+		} \
+		chain = chain->next; \
+	} \
+} while(0);
+
+
+#define CLONE_LUMP_LIST(_p, anchor, list) \
+do { \
+	struct lump* lump_tmp, *l; \
+	struct lump** lump_anchor2, **a; \
+	a = (anchor); \
+	l = (list); \
+	while (l) \
+	{ \
+		lump_clone( (*a) , l , _p ); \
+		/*before list*/ \
+		lump_tmp = l->before; \
+		lump_anchor2 = &((*a)->before); \
+		while ( lump_tmp ) \
+		{ \
+			lump_clone( (*lump_anchor2) , lump_tmp , _p ); \
+			lump_anchor2 = &((*lump_anchor2)->before); \
+			lump_tmp = lump_tmp->before; \
+		} \
+		/*after list*/ \
+		lump_tmp = l->after; \
+		lump_anchor2 = &((*a)->after); \
+		while ( lump_tmp ) \
+		{ \
+			lump_clone( (*lump_anchor2) , lump_tmp , _p ); \
+			lump_anchor2 = &((*lump_anchor2)->after); \
+			lump_tmp = lump_tmp->after; \
+		} \
+		a = &((*a)->next); \
+		l = l->next; \
+	} \
+} while(0)
+
+
+#define CLONE_RPL_LUMP_LIST( _p, _anchor, _list) \
+	do { \
+		rpl_lump_anchor = (_anchor); \
+		for(rpl_lump=(_list);rpl_lump;rpl_lump=rpl_lump->next) { \
+			*(rpl_lump_anchor)=(struct lump_rpl*)(_p); \
+			(_p) += ROUND4(sizeof( struct lump_rpl )); \
+			(*rpl_lump_anchor)->flags = LUMP_RPL_SHMEM | \
+				(rpl_lump->flags&(~(LUMP_RPL_NODUP|LUMP_RPL_NOFREE))); \
+			(*rpl_lump_anchor)->text.len = rpl_lump->text.len; \
+			(*rpl_lump_anchor)->text.s = (_p); \
+			(_p) += ROUND4(rpl_lump->text.len); \
+			memcpy((*rpl_lump_anchor)->text.s,rpl_lump->text.s,rpl_lump->text.len);\
+			(*rpl_lump_anchor)->next=0; \
+			rpl_lump_anchor = &((*rpl_lump_anchor)->next); \
+		}\
+	}while(0);
+
+
+
+/* Takes a SIP msg and makes of a clone on it in shared memory; the clone
+ * is in a single memory chunks (all headers, lumps, etc).
+ * Param "updatable" can be :
+ *    0 - msg cannot be updated -> everything in the single mem chunk
+ *    1 - msg can be updated -> new/dst URI, PATH, lumps are in separate
+ *                              mem chunks, so they can be updated later
+ *    2 - msg can be updated, but do not copy updatable part at cloning
+ */
+struct sip_msg*  sip_msg_cloner( struct sip_msg *org_msg, int *sip_msg_len,
+																int updatable)
 {
-	unsigned int      len;
+	unsigned int      len, l1_len, l2_len, l3_len;
 	struct hdr_field  *hdr,*new_hdr,*last_hdr;
 	struct via_body   *via;
 	struct via_param  *prm;
@@ -318,22 +404,11 @@ struct sip_msg*  sip_msg_cloner( struct sip_msg *org_msg, int *sip_msg_len )
 	struct lump_rpl   *rpl_lump, **rpl_lump_anchor;
 	char              *p;
 
-
 	/*computing the length of entire sip_msg structure*/
 	len = ROUND4(sizeof( struct sip_msg ));
 	/*we will keep only the original msg +ZT */
 	len += ROUND4(org_msg->len + 1);
 
-	/*the new uri (if any)*/
-	if (org_msg->new_uri.s && org_msg->new_uri.len)
-		len += ROUND4(org_msg->new_uri.len);
-
-	if (org_msg->set_global_address.s)
-		len += ROUND4(org_msg->set_global_address.len);
-
-	if (org_msg->set_global_port.s)
-		len += ROUND4(org_msg->set_global_port.len);
-
 	/*all the headers*/
 	for( hdr=org_msg->headers ; hdr ; hdr=hdr->next )
 	{
@@ -419,40 +494,39 @@ struct sip_msg*  sip_msg_cloner( struct sip_msg *org_msg, int *sip_msg_len )
 		}/*switch*/
 	}/*for all headers*/
 
-	/* length of the data lump structures */
-#define LUMP_LIST_LEN(len, list) \
-do { \
-        struct lump* tmp, *chain; \
-	chain = (list); \
-	while (chain) \
-	{ \
-		(len) += lump_len(chain); \
-		tmp = chain->before; \
-		while ( tmp ) \
-		{ \
-			(len) += lump_len( tmp ); \
-			tmp = tmp->before; \
-		} \
-		tmp = chain->after; \
-		while ( tmp ) \
-		{ \
-			(len) += lump_len( tmp ); \
-			tmp = tmp->after; \
-		} \
-		chain = chain->next; \
-	} \
-} while(0);
-
-	LUMP_LIST_LEN(len, org_msg->add_rm);
-	LUMP_LIST_LEN(len, org_msg->body_lumps);
+	/* calculate the "updatable" part of the msg */
 
+	/* length of the data lump structures */
+	l1_len = l2_len = l3_len = 0;
+	LUMP_LIST_LEN(l1_len, org_msg->add_rm);
+	LUMP_LIST_LEN(l2_len, org_msg->body_lumps);
 	/*length of reply lump structures*/
 	for(rpl_lump=org_msg->reply_lump;rpl_lump;rpl_lump=rpl_lump->next)
-			len+=ROUND4(sizeof(struct lump_rpl))+ROUND4(rpl_lump->text.len);
+			l3_len+=ROUND4(sizeof(struct lump_rpl))+ROUND4(rpl_lump->text.len);
+
+	switch (updatable) {
+	case 0: /* no update ever */
+		/* include all the lumps */
+		len += l1_len + l2_len + l3_len;
+		/* the new uri (if any)*/
+		if (org_msg->new_uri.s && org_msg->new_uri.len)
+			len += ROUND4(org_msg->new_uri.len);
+		/* the global address */
+		if (org_msg->set_global_address.s)
+			len += ROUND4(org_msg->set_global_address.len);
+		/* the global port */
+		if (org_msg->set_global_port.s)
+			len += ROUND4(org_msg->set_global_port.len);
+		break;
+	case 1: /* updatable and cloning now */
+	case 2: /* updatable, but no cloning now */
+		/* no additional len processing in these cases */
+		break;
+	}
 
+	/* do all mallocs */
 	p=(char *)shm_malloc(len);
-	if (!p)
-	{
+	if (!p) {
 		LM_ERR("no more share memory\n" );
 		return 0;
 	}
@@ -471,37 +545,7 @@ do { \
 
 	new_msg->msg_flags |= FL_SHM_CLONE;
 	p += ROUND4(sizeof(struct sip_msg));
-	new_msg->add_rm = 0;
-	new_msg->body_lumps = 0;
-
-	/* new_uri */
-	if (org_msg->new_uri.s && org_msg->new_uri.len)
-	{
-		new_msg->new_uri.s = p;
-		memcpy( p , org_msg->new_uri.s , org_msg->new_uri.len);
-		p += ROUND4(org_msg->new_uri.len);
-	}
 
-	/* advertised address and port */
-	if (org_msg->set_global_address.s)
-	{
-		new_msg->set_global_address.s = p;
-		memcpy(p, org_msg->set_global_address.s, org_msg->set_global_address.len);
-		p += ROUND4(org_msg->set_global_address.len);
-	}
-	if (org_msg->set_global_port.s)
-	{
-		new_msg->set_global_port.s = p;
-		memcpy(p, org_msg->set_global_port.s, org_msg->set_global_port.len);
-		p += ROUND4(org_msg->set_global_port.len);
-	}
-
-	/* dst_uri to zero */
-	new_msg->dst_uri.s = 0;
-	new_msg->dst_uri.len = 0;
-	/* path_vec to zero */
-	new_msg->path_vec.s = 0;
-	new_msg->path_vec.len = 0;
 	/* message buffers(org and scratch pad) */
 	memcpy( p , org_msg->buf, org_msg->len);
 	/* ZT to be safer */
@@ -909,67 +953,128 @@ do { \
 		new_msg->last_header = last_hdr;
 	}
 
-	/* cloning data lump */
-#define CLONE_LUMP_LIST(anchor, list) \
-do { \
-	struct lump* lump_tmp, *l; \
-	struct lump** lump_anchor2, **a; \
-	a = (anchor); \
-	l = (list); \
-	while (l) \
-	{ \
-		lump_clone( (*a) , l , p ); \
-		/*before list*/ \
-		lump_tmp = l->before; \
-		lump_anchor2 = &((*a)->before); \
-		while ( lump_tmp ) \
-		{ \
-			lump_clone( (*lump_anchor2) , lump_tmp , p ); \
-			lump_anchor2 = &((*lump_anchor2)->before); \
-			lump_tmp = lump_tmp->before; \
-		} \
-		/*after list*/ \
-		lump_tmp = l->after; \
-		lump_anchor2 = &((*a)->after); \
-		while ( lump_tmp ) \
-		{ \
-			lump_clone( (*lump_anchor2) , lump_tmp , p ); \
-			lump_anchor2 = &((*lump_anchor2)->after); \
-			lump_tmp = lump_tmp->after; \
-		} \
-		a = &((*a)->next); \
-		l = l->next; \
-	} \
-} while(0)
-
-	CLONE_LUMP_LIST(&(new_msg->add_rm), org_msg->add_rm);
-	CLONE_LUMP_LIST(&(new_msg->body_lumps), org_msg->body_lumps);
-
-	/*cloning reply lump structures*/
-	rpl_lump_anchor = &(new_msg->reply_lump);
-	for(rpl_lump=org_msg->reply_lump;rpl_lump;rpl_lump=rpl_lump->next)
-	{
-		*(rpl_lump_anchor)=(struct lump_rpl*)p;
-		p+=ROUND4(sizeof( struct lump_rpl ));
-		(*rpl_lump_anchor)->flags = LUMP_RPL_SHMEM |
-			(rpl_lump->flags&(~(LUMP_RPL_NODUP|LUMP_RPL_NOFREE)));
-		(*rpl_lump_anchor)->text.len = rpl_lump->text.len;
-		(*rpl_lump_anchor)->text.s=p;
-		p+=ROUND4(rpl_lump->text.len);
-		memcpy((*rpl_lump_anchor)->text.s,rpl_lump->text.s,rpl_lump->text.len);
-		(*rpl_lump_anchor)->next=0;
-		rpl_lump_anchor = &((*rpl_lump_anchor)->next);
-	}
-
 	if (clone_authorized_hooks(new_msg, org_msg) < 0) {
-		shm_free(new_msg);
+		free_cloned_msg(new_msg);
 		return 0;
 	}
 
-	return new_msg;
-}
+	/* clone the "updatable" part of the msg */
 
+	switch (updatable) {
+	case 0: /* no update ever -> copy in the same chunk */
+		/* new_uri */
+		if (org_msg->new_uri.s && org_msg->new_uri.len) {
+			new_msg->new_uri.s = p;
+			memcpy( p , org_msg->new_uri.s , org_msg->new_uri.len);
+			p += ROUND4(org_msg->new_uri.len);
+		}
+		/* dst_uri to zero */
+		new_msg->dst_uri.s = 0;
+		new_msg->dst_uri.len = 0;
+		/* path_vec to zero */
+		new_msg->path_vec.s = 0;
+		new_msg->path_vec.len = 0;
+
+		/* advertised address and port */
+		if (org_msg->set_global_address.s) {
+			new_msg->set_global_address.s = p;
+			memcpy(p, org_msg->set_global_address.s, org_msg->set_global_address.len);
+			p += ROUND4(org_msg->set_global_address.len);
+		}
+		if (org_msg->set_global_port.s) {
+			new_msg->set_global_port.s = p;
+			memcpy(p, org_msg->set_global_port.s, org_msg->set_global_port.len);
+			p += ROUND4(org_msg->set_global_port.len);
+		}
 
+		/* clone data lump in the same chunk as sip_msg (not updatable) */
+		new_msg->add_rm = 0;
+		CLONE_LUMP_LIST(p, &(new_msg->add_rm), org_msg->add_rm);
+		new_msg->body_lumps = 0;
+		CLONE_LUMP_LIST(p, &(new_msg->body_lumps), org_msg->body_lumps);
+		new_msg->reply_lump = 0;
+		CLONE_RPL_LUMP_LIST( p, &(new_msg->reply_lump), org_msg->reply_lump);
+
+	case 1: /* updatable and cloning now */
+		new_msg->msg_flags |= FL_SHM_UPDATABLE;
+		/* msg is updatable -> the fields that can be updated are allocated in 
+		 * separate memory chunks */
+		tm_shm_lock();
+		if (org_msg->new_uri.len)
+			new_msg->new_uri.s = (char*)tm_shm_malloc_unsafe( org_msg->new_uri.len );
+		if (org_msg->dst_uri.len)
+			new_msg->dst_uri.s = (char*)tm_shm_malloc_unsafe( org_msg->dst_uri.len );
+		if (org_msg->path_vec.len)
+			new_msg->path_vec.s = (char*)tm_shm_malloc_unsafe( org_msg->path_vec.len );
+		if (org_msg->set_global_address.len)
+			new_msg->set_global_address.s = (char*)tm_shm_malloc_unsafe( org_msg->set_global_address.len );
+		if (org_msg->set_global_port.len)
+			new_msg->set_global_port.s = (char*)tm_shm_malloc_unsafe( org_msg->set_global_port.len );
+		if (l1_len)
+			new_msg->add_rm = (struct lump*)tm_shm_malloc_unsafe(l1_len);
+		if (l2_len)
+			new_msg->body_lumps = (struct lump*)tm_shm_malloc_unsafe(l2_len);
+		if (l3_len)
+			new_msg->reply_lump = (struct lump_rpl*)tm_shm_malloc_unsafe(l3_len);
+		tm_shm_unlock();
+		/*check the malloc result*/
+		if ( (org_msg->new_uri.len && new_msg->new_uri.s==NULL)
+		  || (org_msg->dst_uri.len && new_msg->dst_uri.s==NULL)
+		  || (org_msg->path_vec.len && new_msg->path_vec.s==NULL)
+		  || (org_msg->set_global_address.len && new_msg->set_global_address.s==NULL)
+		  || (org_msg->set_global_port.len && new_msg->set_global_port.s==NULL)
+		  || (l1_len && new_msg->add_rm==NULL)
+		  || (l2_len && new_msg->body_lumps==NULL)
+		  || (l3_len && new_msg->reply_lump==NULL) ) {
+			LM_ERR("failed to sh allocate the updatable part of the msg\n");
+			free_cloned_msg(new_msg);
+			return 0;
+		}
+		/* copy data */
+		if (org_msg->new_uri.len)
+			memcpy( new_msg->new_uri.s, org_msg->new_uri.s, org_msg->new_uri.len);
+		if (org_msg->dst_uri.len)
+			memcpy( new_msg->dst_uri.s, org_msg->dst_uri.s, org_msg->dst_uri.len);
+		if (org_msg->path_vec.len)
+			memcpy( new_msg->path_vec.s, org_msg->path_vec.s, org_msg->path_vec.len);
+		if (org_msg->set_global_address.len)
+			memcpy( new_msg->set_global_address.s, org_msg->set_global_address.s, org_msg->set_global_address.len);
+		if (org_msg->set_global_port.len)
+			memcpy( new_msg->set_global_port.s, org_msg->set_global_port.s, org_msg->set_global_port.len);
+		/* clone lumps */
+		p = (char*)new_msg->add_rm;
+		CLONE_LUMP_LIST( p, &(new_msg->add_rm), org_msg->add_rm);
+		p = (char*)new_msg->body_lumps;
+		CLONE_LUMP_LIST( p, &(new_msg->body_lumps), org_msg->body_lumps);
+		p = (char*)new_msg->reply_lump;
+		CLONE_RPL_LUMP_LIST( p, &(new_msg->reply_lump), org_msg->reply_lump);
+		break;
+
+	case 2: /* updatable, but no cloning now */
+		new_msg->msg_flags |= FL_SHM_UPDATABLE;
+		/* new_uri to zero */
+		new_msg->new_uri.s = 0;
+		new_msg->new_uri.len = 0;
+		/* dst_uri to zero */
+		new_msg->dst_uri.s = 0;
+		new_msg->dst_uri.len = 0;
+		/* path_vec to zero */
+		new_msg->path_vec.s = 0;
+		new_msg->path_vec.len = 0;
+		/* set_global_address to zero */
+		new_msg->set_global_address.s = 0;
+		new_msg->set_global_address.len = 0;
+		/* set_global_port to zero */
+		new_msg->set_global_port.s = 0;
+		new_msg->set_global_port.len = 0;
+		/* set lumps to zero */
+		new_msg->add_rm = 0;
+		new_msg->body_lumps = 0;
+		new_msg->reply_lump = 0;
+		break;
+	}
 
+	return new_msg;
+}
 
 
diff --git a/modules/tm/sip_msg.h b/modules/tm/sip_msg.h
index ecef406f1f7..5c3fab5e5b1 100644
--- a/modules/tm/sip_msg.h
+++ b/modules/tm/sip_msg.h
@@ -28,11 +28,72 @@
 #include "../../parser/msg_parser.h"
 #include "../../mem/shm_mem.h"
 
-#define  sip_msg_free(_p_msg) shm_free( (_p_msg ))
-#define  sip_msg_free_unsafe(_p_msg) shm_free_unsafe( (_p_msg) )
+/* TODO: replace these macros with a more generic approach --liviu */
+#ifdef HP_MALLOC
+	#define tm_shm_malloc_unsafe  shm_malloc
+	#define tm_shm_free_unsafe  shm_free
+	#define tm_destroy_avp_list_unsafe  destroy_avp_list
+	#define tm_shm_lock()
+	#define tm_shm_unlock()
+#else
+	#define tm_shm_malloc_unsafe  shm_malloc_unsafe
+	#define tm_shm_free_unsafe  shm_free_unsafe
+	#define tm_destroy_avp_list_unsafe  destroy_avp_list_unsafe
+	#define tm_shm_lock() shm_lock()
+	#define tm_shm_unlock() shm_unlock()
+#endif
+
+
+#define free_cloned_msg_unsafe( _msg ) \
+	do { \
+		if ((_msg)->msg_flags & FL_SHM_UPDATABLE) { \
+			if ((_msg)->new_uri.s) \
+				tm_shm_free_unsafe((_msg)->new_uri.s);\
+			if ((_msg)->dst_uri.s) \
+				tm_shm_free_unsafe((_msg)->dst_uri.s);\
+			if ((_msg)->path_vec.s) \
+				tm_shm_free_unsafe((_msg)->path_vec.s);\
+			if ((_msg)->set_global_address.s) \
+				tm_shm_free_unsafe((_msg)->set_global_address.s);\
+			if ((_msg)->set_global_port.s) \
+				tm_shm_free_unsafe((_msg)->set_global_port.s);\
+			if ((_msg)->add_rm) \
+				tm_shm_free_unsafe((_msg)->add_rm);\
+			if ((_msg)->body_lumps) \
+				tm_shm_free_unsafe((_msg)->body_lumps);\
+			if ((_msg)->reply_lump) \
+				tm_shm_free_unsafe((_msg)->reply_lump);\
+		}\
+		tm_shm_free_unsafe((_msg));\
+	}while(0)
+
+
+#define free_cloned_msg( _msg ) \
+	do { \
+		if ((_msg)->msg_flags & FL_SHM_UPDATABLE) { \
+			if ((_msg)->new_uri.s) \
+				shm_free((_msg)->new_uri.s);\
+			if ((_msg)->dst_uri.s) \
+				shm_free((_msg)->dst_uri.s);\
+			if ((_msg)->path_vec.s) \
+				shm_free((_msg)->path_vec.s);\
+			if ((_msg)->set_global_address.s) \
+				shm_free((_msg)->set_global_address.s);\
+			if ((_msg)->set_global_port.s) \
+				shm_free((_msg)->set_global_port.s);\
+			if ((_msg)->add_rm) \
+				shm_free((_msg)->add_rm);\
+			if ((_msg)->body_lumps) \
+				shm_free((_msg)->body_lumps);\
+			if ((_msg)->reply_lump) \
+				shm_free((_msg)->reply_lump);\
+		}\
+		shm_free((_msg));\
+	}while(0)
 
 
-struct sip_msg*  sip_msg_cloner( struct sip_msg *org_msg, int *sip_msg_len );
+struct sip_msg*  sip_msg_cloner( struct sip_msg *org_msg, int *sip_msg_len,
+		int updatable );
 
 
 static inline void clean_msg_clone(struct sip_msg *msg,void *min, void *max)
diff --git a/modules/tm/t_reply.c b/modules/tm/t_reply.c
index 6e29e779792..930fe8aeb56 100644
--- a/modules/tm/t_reply.c
+++ b/modules/tm/t_reply.c
@@ -654,7 +654,7 @@ static inline int do_dns_failover(struct cell *t)
 			return -1;
 		}
 		/* now do the actual cloning of the SIP message */
-		t->uas.request = sip_msg_cloner( req, &sip_msg_len);
+		t->uas.request = sip_msg_cloner( req, &sip_msg_len, 1);
 		if (t->uas.request==NULL) {
 			LM_ERR("cloning failed\n");
 			free_sip_msg(req);
@@ -1079,7 +1079,7 @@ static int store_reply( struct cell *trans, int branch, struct sip_msg *rpl)
 		if (rpl==FAKED_REPLY)
 			trans->uac[branch].reply=FAKED_REPLY;
 		else
-			trans->uac[branch].reply = sip_msg_cloner( rpl, 0 );
+			trans->uac[branch].reply = sip_msg_cloner( rpl, 0, 0 );
 
 		if (! trans->uac[branch].reply ) {
 			LM_ERR("failed to alloc' clone memory\n");
@@ -1267,7 +1267,7 @@ enum rps relay_reply( struct cell *t, struct sip_msg *p_msg, int branch,
 error02:
 	if (save_clone) {
 		if (t->uac[branch].reply!=FAKED_REPLY)
-			sip_msg_free( t->uac[branch].reply );
+			free_cloned_msg( t->uac[branch].reply );
 		t->uac[branch].reply = NULL;
 	}
 error01:
diff --git a/modules/tm/uac.c b/modules/tm/uac.c
index 7e823b825dd..5311f2059a9 100644
--- a/modules/tm/uac.c
+++ b/modules/tm/uac.c
@@ -434,7 +434,7 @@ int t_uac(str* method, str* headers, str* body, dlg_t* dialog,
 			}
 abort_update:
 			/* save the SIP message into transaction */
-			new_cell->uas.request = sip_msg_cloner( req, &sip_msg_len);
+			new_cell->uas.request = sip_msg_cloner( req, &sip_msg_len, 1);
 			if (new_cell->uas.request==NULL) {
 				/* reset any T triggering */
 				new_cell->on_negative = 0;
diff --git a/parser/msg_parser.h b/parser/msg_parser.h
index adccf4a577a..689d58a7a18 100644
--- a/parser/msg_parser.h
+++ b/parser/msg_parser.h
@@ -101,11 +101,13 @@ enum request_method {
 #define FL_USE_MEDIA_PROXY   (1<<11) /* use mediaproxy on all messages during
                                       * a dialog */
 #define FL_USE_RTPPROXY      (1<<12) /* used by rtpproxy to remember if the msg
-				      * callback had already been registered */
+                                      * callback had already been registered */
 #define FL_NAT_TRACK_DIALOG  (1<<13) /* trigger dialog tracking from the
                                       * nat_traversal module */
 #define FL_USE_SIPTRACE      (1<<14) /* used by siptrace to check if the tm
-									  * callbacks were registered */
+                                      * callbacks were registered */
+#define FL_SHM_UPDATABLE     (1<<15) /* a SHM cloned message can be updated
+                                      * (TM used, requires FL_SHM_CLONE) */
 
 /* define the # of unknown URI parameters to parse */
 #define URI_MAX_U_PARAMS 10