]> git.ipfire.org Git - thirdparty/asterisk.git/commit
res_pjsip: Prevent crashes when PJPROJECT presents an rdata with no message
authorMatthew Jordan <mjordan@digium.com>
Mon, 6 Oct 2014 00:31:15 +0000 (00:31 +0000)
committerMatthew Jordan <mjordan@digium.com>
Mon, 6 Oct 2014 00:31:15 +0000 (00:31 +0000)
commit69032d62aafe68bef42f0ef2c6d14b845d461e20
tree89f22681272f5bff9693dd323ed8a3dca9b6769b
parentf36b64f58e1799383bf20292e90d5bc490d2ce90
res_pjsip: Prevent crashes when PJPROJECT presents an rdata with no message

When a message that exceeds the PJ_MAX_PKT_SIZE is sent over a reliable
transport, it is possible (although it shouldn't occur) for pjproject to pass
up an rdata object with a NULL msg in the msg_info. Needless to say, things
that attempt to dereference this are in for a rough ride.

In particular, this caused crashes in three different locations, all of which
are 'low level' enough to intercept an rdata object early in processing:

(1) res_pjsip_logger
(2) res_hep_pjsip
(3) res_pjsip/distributor

Anything that can intercept an rdata object before res_pjsip/distributor should
be defensive when looking at the received packet.

#SIPit31

ASTERISK-24369 #close
Reported by: Matt Jordan
........

Merged revisions 424618 from http://svn.asterisk.org/svn/asterisk/branches/12

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/13@424619 65c4cc65-6c06-0410-ace0-fbb531ad65f3
res/res_hep_pjsip.c
res/res_pjsip/pjsip_distributor.c
res/res_pjsip_logger.c