res_pjsip: dtls_handler causes Asterisk to crash

There have been a couple of times where a crash occurred in the dtls_handler
section of the code for res_pjsip. Unfortunately, in working this issue the
problem was unable to be reproduced. After looking at the backtraces and
through the code the current best guess as to why this happened might be due
to a reentrance problem and the strtok function. So, the current fix is to
convert the strtok function into the reentrant version of the function,
strtok_r.

ASTERISK-24741 #close
Reported by: Zane Conkle
Review: https://reviewboard.asterisk.org/r/4409/
........

Merged revisions 431698 from http://svn.asterisk.org/svn/asterisk/branches/13

git-svn-id: https://origsvn.digium.com/svn/asterisk/certified/branches/13.1@431700 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/res/res_pjsip/pjsip_configuration.c b/res/res_pjsip/pjsip_configuration.c
index 10083acc01cf58930a4d0e771c8f1c26be78cda9..67cb863051de5f20c96a5ec92e0d99993fca48dc 100644 (file)
--- a/res/res_pjsip/pjsip_configuration.c
+++ b/res/res_pjsip/pjsip_configuration.c
@@ -646,15 +646,15 @@ static int dtls_handler(const struct aco_option *opt,
 {
        struct ast_sip_endpoint *endpoint = obj;
        char *name = ast_strdupa(var->name);
-       char *front, *buf = name;
+       char *front, *back, *buf = name;
 
        /* strip out underscores in the name */
-       front = strtok(buf, "_");
+       front = strtok_r(buf, "_", &back);
        while (front) {
                int size = strlen(front);
                ast_copy_string(buf, front, size + 1);
                buf += size;
-               front = strtok(NULL, "_");
+               front = strtok_r(NULL, "_", &back);
        }
 
        return ast_rtp_dtls_cfg_parse(&endpoint->media.rtp.dtls_cfg, name, var->value);