From: Scott Griepentrog <scott@griepentrog.com>
Date: Tue, 8 Sep 2015 15:35:57 +0000 (-0500)
Subject: pjsip: avoid possible crash req_caps allocation failure
X-Git-Tag: 13.6.0-rc1~49
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f72f9ceefca52002c45f5910219dbcb0f9437a79;p=thirdparty%2Fasterisk.git

pjsip: avoid possible crash req_caps allocation failure

Make certain that the pjsip session has not failed to
allocate the format capabilities structure, which can
otherwise cause a crash when referenced.

ASTERISK-25323

Change-Id: I602790ba12714741165e441cc64a3ecde4cb5750
---

diff --git a/res/res_pjsip_session.c b/res/res_pjsip_session.c
index 16ed38dd06..6044ceb7fa 100644
--- a/res/res_pjsip_session.c
+++ b/res/res_pjsip_session.c
@@ -1297,6 +1297,11 @@ struct ast_sip_session *ast_sip_session_alloc(struct ast_sip_endpoint *endpoint,
 	session->contact = ao2_bump(contact);
 	session->inv_session = inv_session;
 	session->req_caps = ast_format_cap_alloc(AST_FORMAT_CAP_FLAG_DEFAULT);
+	if (!session->req_caps) {
+		/* Release the ref held by session->inv_session */
+		ao2_ref(session, -1);
+		return NULL;
+	}
 
 	if ((endpoint->dtmf == AST_SIP_DTMF_INBAND) || (endpoint->dtmf == AST_SIP_DTMF_AUTO)) {
 		dsp_features |= DSP_FEATURE_DIGIT_DETECT;