From: Ben Ford <bford@digium.com>
Date: Thu, 25 Feb 2021 19:50:47 +0000 (-0600)
Subject: AST-2021-006 - res_pjsip_t38.c: Check for session_media on reinvite.
X-Git-Tag: 18.3.0-rc1~17
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=77328142b439235d6423345603a0a59905e54c96;p=thirdparty%2Fasterisk.git

AST-2021-006 - res_pjsip_t38.c: Check for session_media on reinvite.

When Asterisk sends a reinvite negotiating T38 faxing, it's possible a
crash can occur if the response contains a m=image and zero port. The
reinvite callback code now checks session_media to see if it is null or
not before trying to access the udptl variable on it.

ASTERISK-29305

Change-Id: I1dfc51c5fa586e38579ede4bc228edee213ccaa9
---

diff --git a/res/res_pjsip_t38.c b/res/res_pjsip_t38.c
index 63abce5abf..5d7f68d095 100644
--- a/res/res_pjsip_t38.c
+++ b/res/res_pjsip_t38.c
@@ -325,7 +325,7 @@ static int t38_reinvite_response_cb(struct ast_sip_session *session, pjsip_rx_da
 		 * If there is a session_media object, but no udptl object available
 		 * then it's assumed the stream was declined.
 		 */
-		if (!session_media->udptl) {
+		if (session_media && !session_media->udptl) {
 			session_media = NULL;
 		}