Description of problem:

opensips dies after first SIP packet with segfault


Version-Release number of selected component (if applicable):

opensips-b2bua-1.10.0-1.fc19.x86_64
opensips-1.10.0-1.fc19.x86_64
opensips-postgresql-1.10.0-1.fc19.x86_64

How reproducible:

100%

Steps to Reproduce:
1.  systemctl start opensips
2.  send in a SIP INVITE
3.  ps -ef|grep opensips ... note its gone

Actual results:

death; lastcomm shows a processed dumped core; nothing in logs

Expected results:

not death


Additional info:


enabled core dumps, ran manually and gdb'd 2 processes that died and dumped core

# gdb /usr/sbin/opensips /core.2693
GNU gdb (GDB) Fedora 7.6.1-41.fc19
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/sbin/opensips...Reading symbols from /usr/lib/debug/usr/sbin/opensips.debug...done.
done.
[New LWP 2693]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/usr/sbin/opensips -P /var/run/opensips/opensips.pid -f /etc/opensips/opensips.'.
Program terminated with signal 11, Segmentation fault.
#0  0x0000000000000000 in ?? ()
(gdb) where
#0  0x0000000000000000 in ?? ()
#1  0x00007ffff07a7225 in replace_uri (msg=msg@entry=0x7ffff55aa250, display=display@entry=0x0, uri=uri@entry=0x7fffffffcb30, hdr=<optimized out>, to=to@entry=0) at replace.c:432
#2  0x00007ffff07a2ef9 in w_replace_from (msg=0x7ffff55aa250, p1=<optimized out>, p2=<optimized out>) at uac.c:389
#3  0x000055555557eef6 in do_action (a=a@entry=0x7ffff55a2af0, msg=msg@entry=0x7ffff55aa250) at action.c:1715
#4  0x0000555555583db8 in run_action_list (a=<optimized out>, msg=msg@entry=0x7ffff55aa250) at action.c:171
#5  0x0000555555581f39 in do_action (a=a@entry=0x7ffff55a3448, msg=msg@entry=0x7ffff55aa250) at action.c:1010
#6  0x0000555555583db8 in run_action_list (a=<optimized out>, msg=msg@entry=0x7ffff55aa250) at action.c:171
#7  0x0000555555581f39 in do_action (a=a@entry=0x7ffff55a3520, msg=msg@entry=0x7ffff55aa250) at action.c:1010
#8  0x0000555555583db8 in run_action_list (a=a@entry=0x7ffff559cfc8, msg=msg@entry=0x7ffff55aa250) at action.c:171
#9  0x0000555555584148 in run_actions (msg=0x7ffff55aa250, a=0x7ffff559cfc8) at action.c:136
#10 run_top_route (a=0x7ffff559cfc8, msg=msg@entry=0x7ffff55aa250) at action.c:211
#11 0x0000555555585c13 in receive_msg (buf=<optimized out>, len=<optimized out>, rcv_info=rcv_info@entry=0x7fffffffddd0) at receive.c:169
#12 0x00005555555a404b in udp_rcv_loop () at udp_server.c:424
#13 0x000055555556ddb8 in main_loop () at main.c:917
#14 main (argc=<optimized out>, argv=<optimized out>) at main.c:1598




gdb /usr/sbin/opensips /core.2699
GNU gdb (GDB) Fedora 7.6.1-41.fc19
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/sbin/opensips...Reading symbols from /usr/lib/debug/usr/sbin/opensips.debug...done.
done.
[New LWP 2699]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/usr/sbin/opensips -P /var/run/opensips/opensips.pid -f /etc/opensips/opensips.'.
Program terminated with signal 11, Segmentation fault.
#0  0x0000000000000000 in ?? ()
(gdb) where
#0  0x0000000000000000 in ?? ()
#1  0x00007ffff07a7225 in replace_uri (msg=msg@entry=0x7ffff55aa250, display=display@entry=0x0, uri=uri@entry=0x7fffffffcb30, hdr=<optimized out>, to=to@entry=0) at replace.c:432
#2  0x00007ffff07a2ef9 in w_replace_from (msg=0x7ffff55aa250, p1=<optimized out>, p2=<optimized out>) at uac.c:389
#3  0x000055555557eef6 in do_action (a=a@entry=0x7ffff55a2af0, msg=msg@entry=0x7ffff55aa250) at action.c:1715
#4  0x0000555555583db8 in run_action_list (a=<optimized out>, msg=msg@entry=0x7ffff55aa250) at action.c:171
#5  0x0000555555581f39 in do_action (a=a@entry=0x7ffff55a3448, msg=msg@entry=0x7ffff55aa250) at action.c:1010
#6  0x0000555555583db8 in run_action_list (a=<optimized out>, msg=msg@entry=0x7ffff55aa250) at action.c:171
#7  0x0000555555581f39 in do_action (a=a@entry=0x7ffff55a3520, msg=msg@entry=0x7ffff55aa250) at action.c:1010
#8  0x0000555555583db8 in run_action_list (a=a@entry=0x7ffff559cfc8, msg=msg@entry=0x7ffff55aa250) at action.c:171
#9  0x0000555555584148 in run_actions (msg=0x7ffff55aa250, a=0x7ffff559cfc8) at action.c:136
#10 run_top_route (a=0x7ffff559cfc8, msg=msg@entry=0x7ffff55aa250) at action.c:211
#11 0x0000555555585c13 in receive_msg (buf=<optimized out>, len=<optimized out>, rcv_info=rcv_info@entry=0x7fffffffddd0) at receive.c:169
#12 0x00005555555a404b in udp_rcv_loop () at udp_server.c:424
#13 0x000055555556ddb8 in main_loop () at main.c:917
#14 main (argc=<optimized out>, argv=<optimized out>) at main.c:1598


Downgrading to these works fine (had been running these for several weeks
without problems):

opensips-1.9.1-1.fc19.x86_64
opensips-postgresql-1.9.1-1.fc19.x86_64
opensips-b2bua-1.9.1-1.fc19.x86_64.rpm


My opensips.cfg contains these (in summary; not prepared to share the whole
actual config):

--
route {
     if (is_method("INVITE")) {
         create_dialog();
         setflag(4);
         setflag(3);
         uac_replace_from("sip:123456789.0.1")
         route(1);
     }
}
--