From: David Vossel <dvossel@digium.com>
Date: Thu, 23 Jun 2011 18:31:00 +0000 (+0000)
Subject: Fixes sip crash when calling remove_uri_parameters with NULL
X-Git-Tag: 1.8.5-rc1~11^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5a8af0d61371c41ced58f13485cc2483efb7b699;p=thirdparty%2Fasterisk.git

Fixes sip crash when calling remove_uri_parameters with NULL

AST-2011-009

(closes issue ASTERISK-18017)
Reported by: jaredmauch



git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@324685 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/channels/sip/reqresp_parser.c b/channels/sip/reqresp_parser.c
index 300acad5e5..40c41ced84 100644
--- a/channels/sip/reqresp_parser.c
+++ b/channels/sip/reqresp_parser.c
@@ -1029,14 +1029,14 @@ int get_in_brackets_full(char *tmp,char **out,char **residue)
 	only affects token based display-names there is no danger of brackets being in quotes */
 	if (first_bracket) {
 		parse = first_bracket;
-		} else {
+	} else {
 		parse = tmp;
 	}
 
 	if ((second_bracket = strchr(parse, '>'))) {
 		*second_bracket++ = '\0';
 		if (out) {
-			*out = first_bracket;
+			*out = (char *) parse;
 		}
 		if (residue) {
 			*residue = second_bracket;
@@ -1045,9 +1045,9 @@ int get_in_brackets_full(char *tmp,char **out,char **residue)
 	}
 
 	if ((first_bracket)) {
-			ast_log(LOG_WARNING, "No closing bracket found in '%s'\n", tmp);
+		ast_log(LOG_WARNING, "No closing bracket found in '%s'\n", tmp);
 		return -1;
-		}
+	}
 
 	if (out) {
 		*out = tmp;
@@ -1076,6 +1076,7 @@ AST_TEST_DEFINE(get_in_brackets_test)
 	char name_no_quotes[] = "name not in quotes <sip:name:secret@host:port;transport=tcp?headers=testblah&headers2=blahblah>";
 	char no_end_bracket[] = "name not in quotes <sip:name:secret@host:port;transport=tcp?headers=testblah&headers2=blahblah";
 	char no_name_no_brackets[] = "sip:name@host";
+	char missing_start_bracket[] = "name not in quotes sip:name:secret@host:port;transport=tcp?headers=testblah&headers2=blahblah>";
 	char *uri = NULL;
 
 	switch (cmd) {
@@ -1140,6 +1141,13 @@ AST_TEST_DEFINE(get_in_brackets_test)
 		res = AST_TEST_FAIL;
 	}
 
+	/* Test 8, no start bracket, but with ending bracket. */
+	if (!(uri = get_in_brackets(missing_start_bracket)) || !(strcmp(uri, in_brackets))) {
+
+		ast_test_status_update(test, "Test 8 failed. %s\n", uri);
+		res = AST_TEST_FAIL;
+	}
+
 	return res;
 }