From: Nick French <nickfrench@gmail.com>
Date: Sat, 19 Dec 2020 17:54:50 +0000 (-0600)
Subject: res_pjsip: Prevent segfault in UDP registration with flow transports
X-Git-Tag: 18.2.0-rc1~15
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3c8598ffef65c8a0735e7364c6ffd138471e6ee5;p=thirdparty%2Fasterisk.git

res_pjsip: Prevent segfault in UDP registration with flow transports

Segfault occurs during outbound UDP registration when all
transport states are being iterated over. The transport object
in the transport is accessed, but flow transports have a NULL
transport object.

Modify to not iterate over any flow transport

ASTERISK-29210 #close

Change-Id: If28dc3a18bdcbd0a49598b09b7fe4404d45c996a
---

diff --git a/res/res_pjsip/pjsip_message_filter.c b/res/res_pjsip/pjsip_message_filter.c
index 1826ee2030..7c91ba853d 100644
--- a/res/res_pjsip/pjsip_message_filter.c
+++ b/res/res_pjsip/pjsip_message_filter.c
@@ -111,7 +111,8 @@ static pjsip_transport *get_udp_transport(pj_str_t *address, int port)
 	}
 
 	for (iter = ao2_iterator_init(transport_states, 0); (transport_state = ao2_iterator_next(&iter)); ao2_ref(transport_state, -1)) {
-		if (transport_state->type == AST_TRANSPORT_UDP &&
+		if (!transport_state->flow &&
+			transport_state->type == AST_TRANSPORT_UDP &&
 			!pj_strcmp(&transport_state->transport->local_name.host, address) &&
 			transport_state->transport->local_name.port == port) {
 			sip_transport = transport_state->transport;