ast_sockaddr_resolve() in netsock2.c may deref a null pointer

Added a null check in netsock2 ast_sockaddr_resolve() as well as added default initalizers in chan_sip parse_uri_legacy_check() to make sure that invalid uris will make null (and not undefined) user,pass,domain,transport variables

(closes issue #19346)
Reported by: kobaz
Patches:
      netsock2.patch uploaded by kobaz (license 834)
Tested by: kobaz, Marquis

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@321100 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index f1f401bfd38a40a0b72824bbbe25c2f6fd17c03a..4aca9b59e7cbc0a6a3aadd71081cb0f0daba6c90 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -13288,6 +13288,20 @@ static int parse_ok_contact(struct sip_pvt *pvt, struct sip_request *req)
 
 /*! \brief parse uri in a way that allows semicolon stripping if legacy mode is enabled */
 static int parse_uri_legacy_check(char *uri, const char *scheme, char **user, char **pass, char **domain, char **transport) {
+       /* Assume invalid to start */
+       if (user) {
+               *user = 0;
+       }
+       if (pass) {
+               *pass = 0;
+       }
+       if (domain) {
+               *domain = 0;
+       }
+       if (transport) {
+               *transport = 0;
+       }
+
        int ret = parse_uri(uri, scheme, user, pass, domain, transport);
        if (sip_cfg.legacy_useroption_parsing) { /* if legacy mode is active, strip semis from the user field */
                char *p;

diff --git a/main/netsock2.c b/main/netsock2.c
index e575bcfa23640ef7bfe0ceeb8187e760575667a4..f57c8425ab163c63cafdfcd5e6c26b3f28739f13 100644 (file)
--- a/main/netsock2.c
+++ b/main/netsock2.c
@@ -232,6 +232,10 @@ int ast_sockaddr_resolve(struct ast_sockaddr **addrs, const char *str,
        char *s, *host, *port;
        int     e, i, res_cnt;
 
+       if (!str) {
+               return 0;
+       }
+
        s = ast_strdupa(str);
        if (!ast_sockaddr_split_hostport(s, &host, &port, flags)) {
                return 0;