From: Sean Bright <sean.bright@gmail.com>
Date: Tue, 12 Dec 2017 21:19:09 +0000 (-0500)
Subject: chan_sip: Don't crash in Dial on invalid destination
X-Git-Tag: 15.2.0-rc1~49^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d22bccef95193b8c5898e25212b1c0b97d3b95b9;p=thirdparty%2Fasterisk.git

chan_sip: Don't crash in Dial on invalid destination

Stripping the DNID in a SIP dial string can result in attempting to call
the argument parsing macros on an empty string, causing a crash.

ASTERISK-26131 #close
Reported by: Dwayne Hubbard
Patches:
	dw-asterisk-master-dnid-crash.patch (license #6257) patch
	uploaded by Dwayne Hubbard

Change-Id: Ib84c1f740a9ec0539d582b09d847fc85ddca1c5e
---

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index a6e5493c26..7b9cc6066e 100644
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -30554,6 +30554,14 @@ static struct ast_channel *sip_request_call(const char *type, struct ast_format_
 		}
 	}
 
+	/* If stripping the DNID left us with nothing, bail out */
+	if (ast_strlen_zero(tmp)) {
+		dialog_unlink_all(p);
+		dialog_unref(p, "unref dialog p from bad destination");
+		*cause = AST_CAUSE_DESTINATION_OUT_OF_ORDER;
+		return NULL;
+	}
+
 	/* Divvy up the items separated by slashes */
 	AST_NONSTANDARD_APP_ARGS(args, tmp, '/');