kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-09-03 03:20:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

res_pjsip_diversion: Fix adding more than one histinfo to Supported

Browse Source 
New responses sent within a PJSIP sessions are based on those that were
sent before. Therefore, adding/modifying a header once causes it to be
sent on all responses that follow.

Sending 181 Call Is Being Forwarded many times first adds "histinfo"
duplicated more and more, and eventually overflows past the array
boundary.

This commit adds a check preventing adding "histinfo" more than once,
and skipping it if there is no more space in the header.

Similar overflow situations can also occur in res_pjsip_path and
res_pjsip_outbound_registration so those were also modified to
check the bounds and suppress duplicate Supported values.

ASTERISK-29227
Reported by: Ivan Poddubny

Change-Id: Id43704a1f1a0293e35cc7f844026f0b04f2ac322
This commit is contained in:
Ivan Poddubnyi
2020-12-28 13:43:23 +01:00
committed by George Joseph
parent e7b13df394
commit 7d15655f9d
3 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
res/res_pjsip_path.c
View File

@@ -123,6 +123,7 @@ static int path_get_string(pj_pool_t *pool, struct ast_sip_contact *contact, pj_
static int add_supported(pjsip_tx_data *tdata)
{
pjsip_supported_hdr *hdr;
int i;
hdr = pjsip_msg_find_hdr(tdata->msg, PJSIP_H_SUPPORTED, NULL);
if (!hdr) {
@@ -135,6 +136,17 @@ static int add_supported(pjsip_tx_data *tdata)
pjsip_msg_add_hdr(tdata->msg, (pjsip_hdr *)hdr);
}
/* Don't add the value if it's already there */
for (i = 0; i < hdr->count; ++i) {
if (pj_stricmp(&hdr->values[i], &PATH_SUPPORTED_NAME) == 0) {
return 0;
}
}
if (hdr->count >= PJSIP_GENERIC_ARRAY_MAX_COUNT) {
return -1;
}
/* add on to the existing Supported header */
pj_strassign(&hdr->values[hdr->count++], &PATH_SUPPORTED_NAME);