kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-09-04 20:04:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

res_pjsip.c: Fix crash from corrupt saved SUBSCRIBE message.

Browse Source 
If the saved SUBSCRIBE message is not parseable for whatever reason then
Asterisk could crash when libpjsip tries to parse the message and adds an
error message to the parse error list.

* Made ast_sip_create_rdata() initialize the parse error rdata list.  The
list is checked after parsing to see that it remains empty for the
function to return successful.

ASTERISK-25306
Reported by Mark Michelson

Change-Id: Ie0677f69f707503b1a37df18723bd59418085256
This commit is contained in:
Richard Mudgett
2015-08-10 18:23:02 -05:00
parent e188192ad1
commit f3f5b45d57
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
res/res_pjsip.c
View File

@@ -2645,6 +2645,12 @@ int ast_sip_create_rdata(pjsip_rx_data *rdata, char *packet, const char *src_nam
{
pj_str_t tmp;
/*
* Initialize the error list in case there is a parse error
* in the given packet.
*/
pj_list_init(&rdata->msg_info.parse_err);
rdata->tp_info.transport = PJ_POOL_ZALLOC_T(rdata->tp_info.pool, pjsip_transport);
if (!rdata->tp_info.transport) {
return -1;
@@ -2655,7 +2661,7 @@ int ast_sip_create_rdata(pjsip_rx_data *rdata, char *packet, const char *src_nam
rdata->pkt_info.src_port = src_port;
pjsip_parse_rdata(packet, strlen(packet), rdata);
if (!rdata->msg_info.msg) {
if (!rdata->msg_info.msg || !pj_list_empty(&rdata->msg_info.parse_err)) {
return -1;
}