smsbox crashes when illegal characters in 'to'

Hi,

I just noticed that whenever there's any illegal character (ie not
specified in sendsms-chars) the smsbox immediately crashes. I am using
Kannel version 1.4.0 via kannel-1.4.0-3.1.fc3.rf.i386.rpm by Dag Wieers
on fedora core 3.

I run my kannel as ..
start-stop-daemon -S -b -x /usr/sbin/smsbox -- -V
0 /etc/kannel/smskannel.conf

My configuration file is as follows..

group = core
admin-port = 13000
smsbox-port = 13001
admin-password = XXX
admin-deny-ip = "*.*.*.*"
admin-allow-ip = "127.0.0.1;192.168.X.Y"
log-file = "/var/log/kannel/kannel.log"
box-deny-ip = "*.*.*.*"
box-allow-ip = "127.0.0.1"
unified-prefix = "00358,0"

group = smsc
smsc = at
smsc-id = GSM
modemtype = wavecom
device = /dev/ttyS0
validityperiod = 167
speed = 9600
#retry = true
my-number = +919811XXXXXX
sms-center = +919811XXXXXX
keepalive = 60
sim-buffering = true

group = modems
id = wavecom
name = "Fargo Maestro 20"
detect-string = "WAVECOM"
need-sleep = true
keepalive-cmd = "AT+CBC;+CSQ"
enable-mms = false
speed = 9600

group = smsbox
bearerbox-host = localhost
sendsms-port = 13013
#global-sender = 13013
#sendsms-chars = "0123456789 +-"
log-file = "/var/log/kannel/smsbox.log"

group = sendsms-user
username = XXX
password = XXX
max-messages = 5
concatenation = true
forced-smsc = GSM
user-deny-ip = "*.*.*.*"
user-allow-ip = "127.0.0.1;192.168.X.Y"

Now the snippet of my log file is as follows ...
2006-08-29 07:05:47 [24323] [2] DEBUG: HTTP: Creating HTTPClient for
`203.1.2.3'.
2006-08-29 07:05:47 [24323] [3] INFO: smsbox: Got HTTP request
</cgi-bin/sendsms> from <203.1.2.3>
2006-08-29 07:05:47 [24323] [3] INFO: sendsms used by <XXX>
2006-08-29 07:05:47 [24323] [3] INFO: Illegal characters in 'to' string
('9810530474,') vs '0123456789 +-'
2006-08-29 07:05:47 [24323] [3] INFO: sendsms sender:<xxx:Nagios>
(203.1.2.3) to:<9810530474, 9873712245> msg:<Service: HTTP
Host: XXX
Address: 203.X.Y.Z
State: CRITICAL
Info: HTTP CRITICAL: HTTP/1.1 500 Internal Server Error
Date: Tue Aug 29 07:05:47 IST 2006>
2006-08-29 07:05:47 [24323] [3] DEBUG: message length 159, sending 1
messages
2006-08-29 07:05:47 [24323] [3] PANIC: gwlib/octstr.c:2340:
seems_valid_real: Assertion `ostr->len + 1 <= ostr->size' failed.
(Called from gw/smsbox.c:2259:smsbox_req_handle.)
2006-08-29 07:05:47 [24323] [3] PANIC: /usr/sbin/smsbox(gw_panic+0xcc)
[0x807a8fc]
2006-08-29 07:05:47 [24323] [3] PANIC: /usr/sbin/smsbox [0x807bb2f]
2006-08-29 07:05:47 [24323] [3]
PANIC: /usr/sbin/smsbox(octstr_get_cstr_real+0x2a) [0x807c85a]
2006-08-29 07:05:47 [24323] [3] PANIC: /usr/sbin/smsbox [0x8057180]
2006-08-29 07:05:47 [24323] [3] PANIC: /usr/sbin/smsbox [0x8059360]
2006-08-29 07:05:47 [24323] [3] PANIC: /usr/sbin/smsbox [0x8071d59]
2006-08-29 07:05:47 [24323] [3] PANIC: /lib/tls/libpthread.so.0
[0x2b7341]
2006-08-29 07:05:47 [24323] [3] PANIC: /lib/tls/libc.so.6(__clone+0x5e)
[0x1f96fe]

And there after that Kaput!. No service running on port 13013.

It is very easy to simulate... by just calling
http://kannelserver:13013/cgi-bin/sendsms?username=XXX&password=YYY&from=Test&text=Hello&to=9810530474,%209873712245

I get this....
2006-08-30 17:15:05 [31532] [2] DEBUG: HTTP: Creating HTTPClient for
`192.168.X.Y'.
2006-08-30 17:15:05 [31532] [3] INFO: smsbox: Got HTTP request
</cgi-bin/sendsms> from <192.168.X.Y>
2006-08-30 17:15:05 [31532] [3] INFO: sendsms used by <XXX>
2006-08-30 17:15:05 [31532] [3] INFO: Illegal characters in 'to' string
('9810530474,') vs '0123456789 +-'
2006-08-30 17:15:05 [31532] [3] INFO: sendsms sender:<XXX:Test>
(192.168.X.Y) to:<9810530474, 9873712245> msg:<Hello>
2006-08-30 17:15:05 [31532] [3] DEBUG: message length 5, sending 1
messages
2006-08-30 17:15:05 [31532] [3] PANIC: gwlib/octstr.c:2340:
seems_valid_real: Assertion `ostr->len + 1 <= ostr->size' failed.
(Called from gw/smsbox.c:2259:smsbox_req_handle.)
2006-08-30 17:15:05 [31532] [3] PANIC: /usr/sbin/smsbox(gw_panic+0xcc)
[0x807a8fc]
2006-08-30 17:15:05 [31532] [3] PANIC: /usr/sbin/smsbox [0x807bb2f]
2006-08-30 17:15:05 [31532] [3]
PANIC: /usr/sbin/smsbox(octstr_get_cstr_real+0x2a) [0x807c85a]
2006-08-30 17:15:05 [31532] [3] PANIC: /usr/sbin/smsbox [0x8057180]
2006-08-30 17:15:05 [31532] [3] PANIC: /usr/sbin/smsbox [0x8059360]
2006-08-30 17:15:05 [31532] [3] PANIC: /usr/sbin/smsbox [0x8071d59]
2006-08-30 17:15:05 [31532] [3] PANIC: /lib/tls/libpthread.so.0
[0x2b7341]
2006-08-30 17:15:05 [31532] [3] PANIC: /lib/tls/libc.so.6(__clone+0x5e)
[0x1f96fe]

When I look through the source code it should ideally just complain
"send-SMS request failed ..." and return. Why is it trying to send the
message? Please help. Thanks a ton in advance!!

Rgds,
Shiv