res_pjsip: dtls_handler causes Asterisk to crash

There have been a couple of times where a crash occurred in the dtls_handler
section of the code for res_pjsip. Unfortunately, in working this issue the
problem was unable to be reproduced. After looking at the backtraces and
through the code the current best guess as to why this happened might be due
to a reentrance problem and the strtok function. So, the current fix is to
convert the strtok function into the reentrant version of the function,
strtok_r.

ASTERISK-24741 #close
Reported by: Zane Conkle
Review: https://reviewboard.asterisk.org/r/4409/
........

Merged revisions 431698 from http://svn.asterisk.org/svn/asterisk/branches/13

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@431699 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/res/res_pjsip/pjsip_configuration.c b/res/res_pjsip/pjsip_configuration.c
index 46e422b33b8bfb8e9f81e7bb075e9244e391b239..edb28501a019f676b4f5f82443e6b8ea9e02c75b 100644 (file)
--- a/res/res_pjsip/pjsip_configuration.c
+++ b/res/res_pjsip/pjsip_configuration.c
@@ -646,15 +646,15 @@ static int dtls_handler(const struct aco_option *opt,
 {
        struct ast_sip_endpoint *endpoint = obj;
        char *name = ast_strdupa(var->name);
-       char *front, *buf = name;
+       char *front, *back, *buf = name;
 
        /* strip out underscores in the name */
-       front = strtok(buf, "_");
+       front = strtok_r(buf, "_", &back);
        while (front) {
                int size = strlen(front);
                ast_copy_string(buf, front, size + 1);
                buf += size;
-               front = strtok(NULL, "_");
+               front = strtok_r(NULL, "_", &back);
        }
 
        return ast_rtp_dtls_cfg_parse(&endpoint->media.rtp.dtls_cfg, name, var->value);