[Osip] Crash after authenticated register!

[Hewanxiang]

My code is simple, it is in a main function, only have a check on the
authentication when it receives a register message.
I use a x-lite to test it. Please see below for detail.
###########################################

       ev = eXosip_event_wait(0, 50);

       if (ev == NULL) {
               ped->et=REPORT_NO_EVENT;
               return 0;
       }

       switch (ev->type) {

       case EXOSIP_MESSAGE_NEW:
       {
               if((ev->request) != NULL && MSG_IS_REGISTER(ev->request)){
                       char *uri_str;
                       osip_uri_to_str(ev->request->from->url, &uri_str);
                       string uri = uri_str;
                       osip_free(uri_str);

                       osip_uri_param_t *param;
                       osip_contact_t *contact;
                       osip_message_get_contact(ev->request, 0, &contact);
                       osip_contact_param_get_byname(contact,
"expires", &param);

		       // unregister:
                       if(param && !strcmp(param->gvalue, "0")){

                               osip_message_t *ok200;
                               eXosip_message_build_answer(ev->tid,
200, &ok200);
                               eXosip_message_send_answer(ev->tid, 200, ok200);

                       }
                       // register:
                       if(param == NULL){

                               osip_authorization_t *h_auth;

osip_message_get_authorization(ev->request, 0, &h_auth);
                               if(!h_auth){
                                       osip_message_t *answer401;

eXosip_message_build_answer(ev->tid, 401, &answer401);

                                       char rand_str[64];
                                       memset(rand_str, 0, 64);
                                       eXosip_generate_random(rand_str, 64);


                                       char www_auth_body[1024];
                                       memset(rand_str, 0, 1024);
                                       snprintf(www_auth_body,
sizeof(www_auth_body),"Digest
realm=\"%s\",algorithm=md5,nonce=\"%s\",stale=false", "bupt506.com",
rand_str);

osip_message_set_header(answer401, "WWW-Authenticate", www_auth_body);


eXosip_message_send_answer(ev->tid, 401, answer401);

                               }else{
                                       if(-1 == auth_check(h_auth)){

                                               osip_message_t *answer401;

eXosip_message_build_answer(ev->tid, 401, &answer401);

                                               char rand_str[64];
                                               memset(rand_str, 0, 64);

eXosip_generate_random(rand_str, 64);


                                               char www_auth_body[1024];
                                               snprintf(www_auth_body,
sizeof(www_auth_body),"Digest
realm=\"%s\",algorithm=MD5,nonce=\"%s\",stale=false", "bupt506.com",
rand_str);

osip_message_set_header(answer401, "WWW-Authenticate", www_auth_body);


eXosip_message_send_answer(ev->tid, 401, answer401);

                                       }else if(0 == auth_check(h_auth)){

                                               osip_message_t *ok200;

eXosip_message_build_answer(ev->tid, 200, &ok200);

eXosip_message_send_answer(ev->tid, 200, ok200);
                                       }
                               }
                       }
               }
	       break;

       }

       case   ------------------
       case   ------------------

       default: {

       }

       }


####################################################################

My problem is, when the x-lite sends my code a register, it looks ok,
and has a authentication check on the register.
After it finished that for about ten seconds, my code will crash on a
segmentation fault, but I do nothing after that.
And the backtrace is :

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1208054864 (LWP 13656)]
0x00881231 in _int_free () from /lib/tls/libc.so.6
(gdb) backtrace
#0  0x00881231 in _int_free () from /lib/tls/libc.so.6
#1  0x00881aca in free () from /lib/tls/libc.so.6
#2  0x001745cc in osip_message_free (sip=0x8fae510) at osip_message.c:125
#3  0x00a97965 in osip_transaction_free2 (transaction=0x8faf458) at
osip_transaction.c:312
#4  0x00a977d2 in osip_transaction_free (transaction=0x8faf458) at
osip_transaction.c:265
#5  0x001ecb63 in eXosip_release_terminated_calls () at udp.c:2701
#6  0x001d71aa in _eXosip_execute () at eXconf.c:720
#7  0x001d75f0 in _eXosip_thread (arg=0x0) at eXconf.c:861
#8  0x00a663ae in start_thread () from /lib/tls/libpthread.so.0
#9  0x008e6aee in clone () from /lib/tls/libc.so.6
(gdb)

Could anybody help me please ?
Thanks in advance.

-- 
Best Regards.