Skip to content

[BUG] cgrates: empty session tag triggers undefined memcpy during dialog persistence #4131

Description

@kimaiden1984-boop

OpenSIPS version

version: opensips 4.1.0-dev (x86_64/linux)
git revision: 0cab946

Describe the bug

The fourth cgrates_acc() argument (session tag) is optional. When it is omitted, the session tag is represented as { .s = NULL, .len = 0 }.

During dialog-variable persistence, cgr_dlg_onwrite() calls:

memcpy(p, s->tag.s, s->tag.len);

This passes a NULL source pointer to memcpy(), even though the length is zero. A Clang UBSan build reports undefined behavior.

To reproduce

Enable dialog persistence and call cgrates_acc() without its optional tag:

modparam("dialog", "db_mode", 1)
modparam("dialog", "db_flush_vals_profiles", 1)

route {
    create_dialog();
    cgrates_acc("cdr", "alice", "bob");
    t_relay();
}

Send an INVITE and have the downstream UAS return a tagged 200 response. When the confirmed dialog is persisted, UBSan reports:

modules/cgrates/cgrates_acc.c:791:14: runtime error:
null pointer passed as argument 2, which is declared to never be null

Using a non-empty fourth argument traverses the same persistence path without the diagnostic.

Expected behavior

An empty optional tag should be serialized without invoking memcpy() with a NULL pointer.

Proposed fix

- memcpy(p, s->tag.s, s->tag.len);
+ if (s->tag.len)
+     memcpy(p, s->tag.s, s->tag.len);

This does not change the serialized format: an empty tag still contributes zero payload bytes.

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions