From: Ben Ford <bford@digium.com>
Date: Fri, 8 Nov 2019 19:21:15 +0000 (-0600)
Subject: res_pjsip_session.c: Check for port of zero on incoming SDP.
X-Git-Tag: 13.30.0-rc1~13^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c257794330db49f4079a7108d51da60696269b36;p=thirdparty%2Fasterisk.git

res_pjsip_session.c: Check for port of zero on incoming SDP.

If a re-invite comes in initiating T.38, but there is no c line in the
SDP and the port is also 0, a crash can occur. A check is now done on
the port to see if the steam is already declined, preventing the crash.
The logic was moved to res_pjsip_session.c because it is handled in a
similar manner in later versions of Asterisk.

ASTERISK-28612
Reported by: Salah Ahmed

Change-Id: Ifc4a0d05b32c7f2156e77fc8435a6ecaa6abada0
---

diff --git a/res/res_pjsip_session.c b/res/res_pjsip_session.c
index 81f36a7201..12cf41deb3 100644
--- a/res/res_pjsip_session.c
+++ b/res/res_pjsip_session.c
@@ -235,6 +235,13 @@ static int handle_incoming_sdp(struct ast_sip_session *session, const pjmedia_sd
 			continue;
 		}
 
+		/* If we have a port of 0, ignore this stream */
+		if (!sdp->media[i]->desc.port) {
+			ast_debug(1, "Declining incoming SDP media stream '%s' at position '%d'\n",
+				session_media->stream_type, i);
+			continue;
+		}
+
 		if (session_media->handler) {
 			handler = session_media->handler;
 			ast_debug(1, "Negotiating incoming SDP media stream '%s' using %s SDP handler\n",