[PATCH] Smsbox Crash
"Mi Reflejo" <[email protected]>
| Newsgroups | gmane.comp.mobile.kannel.devel |
|---|---|
| Message-ID | <[email protected]> |
How to reproduce it: # curl -H "Content-type: text/html" -d "uel&from=1010&to=111111&text=Invalid Keyword&binfo=" http://127.0.0.1:13002/cgi-bin/sendsms Logs: 2007-01-10 15:56:05 [13414] [3] PANIC: gwlib/octstr.c:2476: seems_valid_real: Assertion `ostr->data != NULL' failed. (Called from gwlib/octstr.c:318:octstr_destroy.) 2007-01-10 15:56:05 [13414] [1] DEBUG: HTTP: Destroying HTTPClient area 0x8159a90. 2007-01-10 15:56:05 [13414] [1] DEBUG: HTTP: Destroying HTTPClient for `127.0.0.1'. 2007-01-10 15:56:05 [13414] [3] PANIC: gw/smsbox(gw_panic+0xcc) [0x808845c] 2007-01-10 15:56:05 [13414] [3] PANIC: gw/smsbox [0x80896e8] 2007-01-10 15:56:05 [13414] [3] PANIC: gw/smsbox(octstr_destroy+0x2a) [0x8089dfa] 2007-01-10 15:56:05 [13414] [3] PANIC: gw/smsbox [0x805b3ff] 2007-01-10 15:56:05 [13414] [3] PANIC: gw/smsbox [0x807f070] 2007-01-10 15:56:05 [13414] [3] PANIC: /lib/libpthread.so.0 [0xb7f2e604] 2007-01-10 15:56:05 [13414] [3] PANIC: /lib/libc.so.6(__clone+0x5e) [0xb7c5c09e] Problem: The var body is filled with the pointer to text and then destroyed twice- Fixed in the attached Patch. Martin.
smsbox.crash.patch
(text/x-patch, 422 B)
--- gw/smsbox.c.orig 2007-01-10 16:07:01.566692000 -0300 +++ gw/smsbox.c 2007-01-10 16:06:44.777642750 -0300 @@ -2601,7 +2601,8 @@ text = html_to_sms(body); octstr_strip_blanks(text); octstr_destroy(body); - body = text; + body = octstr_duplicate(text); + octstr_destroy(text); get_x_kannel_from_headers(headers, &from, &to, &udh, &user, &pass, &smsc, &mclass, &mwi, &coding, &compress, &validity,