From: Torrey Searle <torrey@voxbone.com>
Date: Tue, 27 Jun 2017 15:46:43 +0000 (+0200)
Subject: res/res_pjsip_t38: fix incorrect increment of media_count
X-Git-Tag: 14.6.0-rc1~15
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3f1e34bd7cca7decbe6195bb9be96f7ff3e29d5f;p=thirdparty%2Fasterisk.git

res/res_pjsip_t38: fix incorrect increment of media_count

The T38 sdp callback incorrectly has a side effect of incrementing
the media_count.  This can lead to core dumps.

Change-Id: I7bb2f4987de4046ec52cfc34e5ea0662dae32af8
---

diff --git a/res/res_pjsip_t38.c b/res/res_pjsip_t38.c
index 76434928e7..3028d35f60 100644
--- a/res/res_pjsip_t38.c
+++ b/res/res_pjsip_t38.c
@@ -278,7 +278,7 @@ static int t38_reinvite_sdp_cb(struct ast_sip_session *session, pjmedia_sdp_sess
 	/* Move the image media stream to the front and have it as the only stream, pjmedia will fill in
 	 * dummy streams for the rest
 	 */
-	for (stream = 0; stream < sdp->media_count++; ++stream) {
+	for (stream = 0; stream < sdp->media_count; ++stream) {
 		if (!pj_strcmp2(&sdp->media[stream]->desc.media, "image")) {
 			sdp->media[0] = sdp->media[stream];
 			sdp->media_count = 1;