Crash: Wrong assert() in SIP::SIPEngine::MODSendERROR()

[chemeris]

Function SIPEngine::MODSendERROR() tries to access associated INVITE and checks that it exists with assert(), which leads to a crash when this happens. this should be fixed and either assert replaced with a graceful error check or the condition to be checked by a caller.

openbts-2.8/SIP/SIPEngine.cpp

Line 733 in 386f5a0

assert(mINVITE);

From the user report:

This is the log after a successful transmission of sms:

Feb  1 15:33:43 ubuntuVM openbts: INFO 140258990905152 RadioResource.cpp:388:addID: IMSI=310410549131620 added to table
Feb  1 15:33:43 ubuntuVM openbts: INFO 140258944079616 RadioResource.cpp:432:pageAll: paging 1 mobile(s)
Feb  1 15:34:04  openbts: last message repeated 46 times
Feb  1 15:34:04 ubuntuVM openbts: INFO 140258943813376 RadioResource.cpp:152:AccessGrantResponder: RA=0x18 when=0:1033991 age=6 delay=1.68359 RSSI=0
Feb  1 15:34:04 ubuntuVM openbts: INFO 140258943813376 RadioResource.cpp:234:AccessGrantResponder: sending PageMode=(0) DedicatedModeOrTBF=(TMA=0 Downlink=0 DMOrTBF=0) ChannelDescription=(typeAndOffset=SDCCH/4-0 TN=0 TSC=2 ARFCN=51) RequestReference=(RA=24 T1'=11 T2=23 T3=17) TimingAdvance=2
Feb  1 15:34:05 ubuntuVM openbts: INFO 140258963781376 RadioResource.cpp:265:PagingResponseHandler: RR Paging Response mobileID=(IMSI=310410549131620) classmark=(revision=1 ES-IND=1 A5/1=0 A5/2=0 A5/3=0 powerCap=3 PS=1 SSScrenInd=1 SM=1 VBS=0 VGCS=0 FC=1 CM3=1 LCSVA=1 SoLSA=0 CMSF=1)
Feb  1 15:34:05 ubuntuVM openbts: INFO 140258963781376 RadioResource.cpp:396:removeID: IMSI=310410549131620
Feb  1 15:34:05 ubuntuVM openbts: INFO 140258963781376 SMSControl.cpp:482:MTSMSController: transaction: 1361672867 C0T0 SDCCH/4-0 IMSI=310410549131620 L3TI=4 SIP-call-id=2070025045 SIP-proxy=127.0.0.1:5063 MTSMS from=1112223333 GSMState=SMS-delivery SIPState=Null (0 sec) message=""Send this WHYYYY detection data via "
Feb  1 15:34:05 ubuntuVM openbts: INFO 140258963781376 SMSControl.cpp:389:deliverSMSToMS: sending CP-DATA TI=4 RPDU=(01d503a100000033040aa1112122333300003120105143500a25a269d94d06d1d1e939e88acc66b35910b94c2f8fe9e9b71b440ed3c3207b3a0c02)
Feb  1 15:34:06 ubuntuVM openbts: INFO 140258963781376 SMSControl.cpp:449:deliverSMSToMS: MTSMS: sending CPAck
Feb  1 15:34:07 ubuntuVM openbts: INFO 140258963781376 SMSControl.cpp:498:MTSMSController: closing the Um channel

And after an unsuccessful sendsms followed by a crash I see:

Feb  1 15:55:55 ubuntuVM openbts: INFO 140622458263360 RadioResource.cpp:388:addID: IMSI=310410549131620 added to table
Feb  1 15:55:55 ubuntuVM openbts: INFO 140622411437824 RadioResource.cpp:432:pageAll: paging 1 mobile(s)
Feb  1 15:56:25  openbts: last message repeated 63 times
Feb  1 15:56:25 ubuntuVM openbts: INFO 140622411437824 RadioResource.cpp:424:pageAll: erasing IMSI=310410549131620
AND SOMETIMES
Feb  1 13:32:14 ubuntuVM openbts: INFO 139961903224576 SIPEngine.cpp:731:MODSendERROR: user IMSI310410549131620 state Null

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `./OpenBTS'.
Program terminated with signal 6, Aborted.
#0  0x00007fa8ab5b3425 in raise () from /lib/x86_64-linux-gnu/libc.so.6
(gdb) bt
#0  0x00007fa8ab5b3425 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x00007fa8ab5b6b8b in abort () from /lib/x86_64-linux-gnu/libc.so.6
#2  0x00007fa8ab5ac0ee in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#3  0x00007fa8ab5ac192 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
#4  0x0000000000433d6f in SIP::SIPEngine::MODSendERROR (this=0xc392f8, 
    cause=<optimized out>, code=480, 
    reason=0x546059 "Temporarily Unavailable", cancel=true)
    at SIPEngine.cpp:733
#5  0x0000000000485d59 in Control::TransactionEntry::MODSendERROR (
    this=0xc39220, cause=0x0, code=480, 
    reason=0x546059 "Temporarily Unavailable", cancel=true)
    at TransactionTable.cpp:663
#6  0x000000000048780f in Control::TransactionTable::removePaging (
    this=<optimized out>, key=514452152) at TransactionTable.cpp:958
#7  0x00000000004b07a4 in Control::Pager::pageAll (this=0x78dea0)
    at RadioResource.cpp:426
#8  0x00000000004b11d8 in Control::Pager::serviceLoop (this=0x78dea0)
    at RadioResource.cpp:495
#9  0x00000000004b1549 in Control::PagerServiceLoopAdapter (
    pager=<optimized out>) at RadioResource.cpp:481
#10 0x00007fa8ac155e9a in start_thread ()
   from /lib/x86_64-linux-gnu/libpthread.so.0
#11 0x00007fa8ab670cbd in clone () from /lib/x86_64-linux-gnu/libc.so.6
#12 0x0000000000000000 in ?? ()
(gdb) info frame
Stack level 0, frame at 0x7fa8a974f070:
 rip = 0x7fa8ab5b3425 in raise; saved rip 0x7fa8ab5b6b8b
 called by frame at 0x7fa8a974f1a0
 Arglist at 0x7fa8a974f060, args: 
 Locals at 0x7fa8a974f060, Previous frame's sp is 0x7fa8a974f070
 Saved registers:
  rip at 0x7fa8a974f068