OpenSIPS version
version: opensips 4.1.0-dev (x86_64/linux)
git revision: 0cab946
Describe the bug
The fourth cgrates_acc() argument (session tag) is optional. When it is omitted, the session tag is represented as { .s = NULL, .len = 0 }.
During dialog-variable persistence, cgr_dlg_onwrite() calls:
memcpy(p, s->tag.s, s->tag.len);
This passes a NULL source pointer to memcpy(), even though the length is zero. A Clang UBSan build reports undefined behavior.
To reproduce
Enable dialog persistence and call cgrates_acc() without its optional tag:
modparam("dialog", "db_mode", 1)
modparam("dialog", "db_flush_vals_profiles", 1)
route {
create_dialog();
cgrates_acc("cdr", "alice", "bob");
t_relay();
}
Send an INVITE and have the downstream UAS return a tagged 200 response. When the confirmed dialog is persisted, UBSan reports:
modules/cgrates/cgrates_acc.c:791:14: runtime error:
null pointer passed as argument 2, which is declared to never be null
Using a non-empty fourth argument traverses the same persistence path without the diagnostic.
Expected behavior
An empty optional tag should be serialized without invoking memcpy() with a NULL pointer.
Proposed fix
- memcpy(p, s->tag.s, s->tag.len);
+ if (s->tag.len)
+ memcpy(p, s->tag.s, s->tag.len);
This does not change the serialized format: an empty tag still contributes zero payload bytes.
OpenSIPS version
Describe the bug
The fourth
cgrates_acc()argument (session tag) is optional. When it is omitted, the session tag is represented as{ .s = NULL, .len = 0 }.During dialog-variable persistence,
cgr_dlg_onwrite()calls:This passes a NULL source pointer to
memcpy(), even though the length is zero. A Clang UBSan build reports undefined behavior.To reproduce
Enable dialog persistence and call
cgrates_acc()without its optional tag:Send an INVITE and have the downstream UAS return a tagged 200 response. When the confirmed dialog is persisted, UBSan reports:
Using a non-empty fourth argument traverses the same persistence path without the diagnostic.
Expected behavior
An empty optional tag should be serialized without invoking
memcpy()with a NULL pointer.Proposed fix
This does not change the serialized format: an empty tag still contributes zero payload bytes.