1.11.3 crashes when using request context from the onreply_route

[gergelypeli]

I just tried using $(ru) in an xlog from the onreply_route (should work according to the Core Variables doc page), but got a crash:

#0  tm_pv_context_request (msg=<optimized out>) at tm.c:1645
#1  0x0000000000449ca2 in pv_get_spec_value (msg=0x7f8a1dec19d0, sp=0x7f8a1deb5b10, value=0x7fff2089c740) at pvar.c:3907
#2  0x000000000044c9b0 in pv_printf (msg=0x7f8a1dec19d0, list=<optimized out>, buf=<optimized out>, len=0x7fff2089c7ec) at pvar.c:3992
#3  0x000000000049f0f0 in xl_print_log (msg=0x7f8a1dec19d0, list=0x7f8a1deb5b00, len=0x7fff2089c7ec) at xlog.c:67
#4  0x000000000049f364 in xlog_1 (msg=0x7f8a1dec19d0, frm=0x7f8a1deb5b10 "\016", str2=<optimized out>) at xlog.c:116
#5  0x0000000000419308 in do_action (a=0x7f8a1deb5da8, msg=0x7f8a1dec19d0) at action.c:1626
#6  0x0000000000413a10 in run_action_list (a=<optimized out>, msg=0x7f8a1dec19d0) at action.c:171
#7  0x0000000000418fc2 in do_action (a=0x7f8a1deb6160, msg=0x7f8a1dec19d0) at action.c:1103
#8  0x0000000000413a10 in run_action_list (a=<optimized out>, msg=0x7f8a1dec19d0) at action.c:171
#9  0x0000000000419e02 in do_action (a=0x7f8a1deb6238, msg=0x7f8a1dec19d0) at action.c:1109
#10 0x0000000000413a10 in run_action_list (a=<optimized out>, msg=0x7f8a1dec19d0) at action.c:171
#11 0x000000000041abf8 in run_actions (msg=<optimized out>, a=<optimized out>) at action.c:136
#12 run_top_route (a=0x7f8a1deb6238, msg=0x7f8a1dec19d0) at action.c:211
#13 0x0000000000453a04 in receive_msg (
    buf=0x7756a0 "SIP/2.0 100 Trying\r\nVia: SIP/2.0/UDP"..., len=527, rcv_info=<optimized out>)
    at receive.c:206
#14 0x000000000049b414 in udp_rcv_loop () at udp_server.c:424
#15 0x000000000042f17b in main_loop () at main.c:942
#16 main (argc=<optimized out>, argv=<optimized out>) at main.c:1634

Reproducible always. The version is:

version: opensips 1.11.3-notls (x86_64/linux)
flags: STATS: On, USE_IPV6, USE_TCP, DISABLE_NAGLE, USE_MCAST, SHM_MEM, SHM_MMAP, PKG_MALLOC, F_MALLOC, FAST_LOCK-ADAPTIVE_WAIT
ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
git revision: dee7da4
main.c compiled on 13:17:30 Oct 15 2014 with gcc 4.4.5

[bogdan-iancu]

Hi @gergelypeli , please post the exact xlog line you have in the script . Additionally, in gdb frame 0, print "trans" .
Thanks, Bogdan

[gergelypeli]

I just noticed that the context specification was stripped from my original report (because of the angle brackets? I'll try with HTML entities then). The xlog call was simply:

xlog("XXX $(<request>ru)");

The print you requested:

(gdb) print trans
$1 = (struct cell *) 0xffffffffffffffff

[bogdan-iancu]

do you do the xlog from the default onreply route (the one without name) ?

[gergelypeli]

Yes. I figured out that AVPs are only visible in "t_onreply_route"-armed "onreply_route"-s (which does not seem to be documented at tm's "onreply_avp_mode" param), but I expected PVs to work without any transactions set up.

[bogdan-iancu]

Indeed, we need a fix to prevent the crash, but that PV (with request context) will not work in the default reply route - that route has no transaction context, so no way to reach the SIP requests and get the RURI.