Correct handling of unknown SDP stream types

When the patch to handle arbitrary SDP stream arrangements went into
Asterisk, it also included an ability to transparently decline unknown
stream types. The scanf calls used were not checked properly causing
this part of the functionality to be broken.

(closes issue ASTERISK-20203)
........

Merged revisions 373211 from http://svn.asterisk.org/svn/asterisk/branches/11

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@373212 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index b5b7da6c8cd8a0a7ebc572862011c3e2c8fcefce..dd64867e8d36da56911aafe5c389db3d35595e7f 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -9871,10 +9871,8 @@ static int process_sdp(struct sip_pvt *p, struct sip_request *req, int t38action
                        }
                } else {
                        char type[20] = {0,};
-                       char *typelen = strchr(m, ' ');
-                       if (typelen && typelen - m < 20 &&
-                           ((sscanf(m, "%s %30u/%30u %n", type, &x, &numberofports, &len) == 2 && len > 0) ||
-                            (sscanf(m, "%s %30u %n", type, &x, &len) == 1 && len > 0))) {
+                       if ((sscanf(m, "%19s %30u/%30u %n", type, &x, &numberofports, &len) == 3 && len > 0) ||
+                            (sscanf(m, "%19s %30u %n", type, &x, &len) == 2 && len > 0)) {
                                /* produce zero-port m-line since it may be needed later
                                 * length is "m=" + type + " 0 " + remainder + "\0" */
                                if (!(offer->decline_m_line = ast_malloc(2 + strlen(type) + 3 + strlen(m + len) + 1))) {