I run into the following crash on a system using trunk r8673:
#0 0xb7216bfa in calc_buf_len (c=0xaf773ce0) at reply.c:146
#1 build_contact (c=0xaf773ce0) at reply.c:215
#2 0xb721aae5 in add_contacts (_m=0x84eeb50, forced_binding=0x0, _d=0xaf710ebc "@\016q�", _f=0x0, _s=0x0) at save.c:678
#3 save_aux (_m=0x84eeb50, forced_binding=0x0, _d=0xaf710ebc "@\016q�", _f=0x0, _s=0x0) at save.c:800
#4 0xb721b347 in save (_m=0x84eeb50, _d=0xaf710ebc "@\016q�", _f=0x0, _s=0x0) at save.c:847
#5 0x0805a345 in do_action (a=0x843f0d0, msg=0x84eeb50) at action.c:1454
I inspected the trace and I saw that the ucontact struct (c) does have the instance field set, but the REGISTER didn't contain any GRUU. It actually contains the domain part of the AoR.
It segfaults because the sock element of the structure is NULL and calc_buf_len assumes it's not in case instance is set, but how instance got set without a +sip.instance parameter in the Contact header eludes me.
I did try to reproduce this, but couldn't. It happened on a production server which I had to downgrade to avoid this.
I saved several coredumps exactly like this, so if more information is needed please let me know.
Thanks and regards,