res_pjsip_sdp_rtp,sorcery: Fix invalid access and memory leak respectively.

Valgrind found a memory leak and invalid access.

* Fix invalid access by sscanf() being fed a non-nul terminated string of
digits in res/res_pjsip_sdp_rtp.c:get_codecs().

* Fix memory leak in main/sorcery.c:sorcery_object_field_destructor().

* Fix potential NULL pointer dereference in
main/xmldoc.c:xmldoc_get_syntax_config_option().

Review: https://reviewboard.asterisk.org/r/4513/
........

Merged revisions 433199 from http://svn.asterisk.org/svn/asterisk/branches/13

git-svn-id: https://origsvn.digium.com/svn/asterisk/certified/branches/13.1@433201 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/main/sorcery.c b/main/sorcery.c
index 50e5e4756653d935a2dc2e7161000d91a302de90..03c6b706490aa18789b2d9bcd906f2b44b1405f6 100644 (file)
--- a/main/sorcery.c
+++ b/main/sorcery.c
@@ -1074,6 +1074,7 @@ static void sorcery_object_field_destructor(void *obj)
 
        if (object_field->name_regex) {
                regfree(object_field->name_regex);
+               ast_free(object_field->name_regex);
        }
 }
 

diff --git a/main/xmldoc.c b/main/xmldoc.c
index 2a17e5287c517900ff8227ef90278f4368ff933c..0374aeff352f7a19451bc50eeafc3a177d3d7a9f 100644 (file)
--- a/main/xmldoc.c
+++ b/main/xmldoc.c
@@ -1239,7 +1239,7 @@ static char *xmldoc_get_syntax_config_option(struct ast_xml_node *fixnode, const
        regex = ast_xml_get_attribute(fixnode, "regex");
        ast_str_set(&syntax, 0, "%s = [%s] (Default: %s) (Regex: %s)\n",
                name,
-               type,
+               type ?: "",
                default_value ?: "n/a",
                regex ?: "False");
 

diff --git a/res/res_pjsip_sdp_rtp.c b/res/res_pjsip_sdp_rtp.c
index 98c998ce44868a7806714f54c3e8acd05f72d3fb..1994db7f3cd3da5ef4f816e4c3d4efe76d031585 100644 (file)
--- a/res/res_pjsip_sdp_rtp.c
+++ b/res/res_pjsip_sdp_rtp.c
@@ -183,7 +183,11 @@ static void get_codecs(struct ast_sip_session *session, const struct pjmedia_sdp
                }
 
                if ((pjmedia_sdp_attr_get_fmtp(attr, &fmtp)) == PJ_SUCCESS) {
-                       sscanf(pj_strbuf(&fmtp.fmt), "%d", &num);
+                       ast_copy_pj_str(fmt_param, &fmtp.fmt, sizeof(fmt_param));
+                       if (sscanf(fmt_param, "%30d", &num) != 1) {
+                               continue;
+                       }
+
                        if ((format = ast_rtp_codecs_get_payload_format(codecs, num))) {
                                struct ast_format *format_parsed;