AST-2013-004: Fix crash when handling ACK on dialog that has no channel

A remote exploitable crash vulnerability exists in the SIP channel driver if an
ACK with SDP is received after the channel has been terminated. The handling
code incorrectly assumed that the channel would always be present.

This patch adds a check such that the SDP will only be parsed and applied if
Asterisk has a channel present that is associated with the dialog.

Note that the patch being applied was modified only slightly from the patch
provided by Walter Doekes of OSSO B.V.

(closes issue ASTERISK-21064)
Reported by: Colin Cuthbertson
Tested by: wdoekes, Colin Cutherbertson
patches:
  issueA21064_fix.patch uploaded by wdoekes (License 5674)
........

Merged revisions 397710 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 397711 from http://svn.asterisk.org/svn/asterisk/branches/10
........

Merged revisions 397712 from http://svn.asterisk.org/svn/asterisk/branches/11
........

Merged revisions 397713 from http://svn.asterisk.org/svn/asterisk/branches/12

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@397753 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 58ee175c54650d0f6f69a294c8836c2ceccbcb9b..46d803c7ee945270f3e9c815b12421b084b0ebd9 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -28167,7 +28167,7 @@ static int handle_incoming(struct sip_pvt *p, struct sip_request *req, struct as
                        p->invitestate = INV_TERMINATED;
                        p->pendinginvite = 0;
                        acked = __sip_ack(p, seqno, 1 /* response */, 0);
-                       if (find_sdp(req)) {
+                       if (p->owner && find_sdp(req)) {
                                if (process_sdp(p, req, SDP_T38_NONE)) {
                                        return -1;
                                }