res_pjsip: Prevent segfault in UDP registration with flow transports

Segfault occurs during outbound UDP registration when all
transport states are being iterated over. The transport object
in the transport is accessed, but flow transports have a NULL
transport object.

Modify to not iterate over any flow transport

ASTERISK-29210 #close

Change-Id: If28dc3a18bdcbd0a49598b09b7fe4404d45c996a

diff --git a/res/res_pjsip/pjsip_message_filter.c b/res/res_pjsip/pjsip_message_filter.c
index 1826ee20300769121c04d9f6a07be9d1e1c5f1db..7c91ba853d5ecccfec0c4e580edf6954ceb41df7 100644 (file)
--- a/res/res_pjsip/pjsip_message_filter.c
+++ b/res/res_pjsip/pjsip_message_filter.c
@@ -111,7 +111,8 @@ static pjsip_transport *get_udp_transport(pj_str_t *address, int port)
        }
 
        for (iter = ao2_iterator_init(transport_states, 0); (transport_state = ao2_iterator_next(&iter)); ao2_ref(transport_state, -1)) {
-               if (transport_state->type == AST_TRANSPORT_UDP &&
+               if (!transport_state->flow &&
+                       transport_state->type == AST_TRANSPORT_UDP &&
                        !pj_strcmp(&transport_state->transport->local_name.host, address) &&
                        transport_state->transport->local_name.port == port) {
                        sip_transport = transport_state->transport;