From 21abdc2d9aa470022a48e01339f7eb365428f4ad Mon Sep 17 00:00:00 2001 From: Richard Mudgett Date: Mon, 3 Apr 2017 15:38:06 -0500 Subject: [PATCH] res_pjsip_sdp_rtp.c: Don't alter global addr variable. * create_rtp(): Fix unexpected alteration of global address_rtp if a transport is bound to an address. * create_rtp(): Fix use of uninitialized memory if the endpoint RTP media address is invalid or the transport has an invalid address. ASTERISK-26851 Change-Id: Icde42e65164a88913cb5c2601b285eebcff397b7 --- res/res_pjsip_sdp_rtp.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/res/res_pjsip_sdp_rtp.c b/res/res_pjsip_sdp_rtp.c index 95aae55fdf..cbb2bef8c0 100644 --- a/res/res_pjsip_sdp_rtp.c +++ b/res/res_pjsip_sdp_rtp.c @@ -199,8 +199,16 @@ static int create_rtp(struct ast_sip_session *session, struct ast_sip_session_me struct ast_sockaddr *media_address = &address_rtp; if (session->endpoint->media.bind_rtp_to_media_address && !ast_strlen_zero(session->endpoint->media.address)) { - ast_sockaddr_parse(&temp_media_address, session->endpoint->media.address, 0); - media_address = &temp_media_address; + if (ast_sockaddr_parse(&temp_media_address, session->endpoint->media.address, 0)) { + ast_debug(1, "Endpoint %s: Binding RTP media to %s\n", + ast_sorcery_object_get_id(session->endpoint), + session->endpoint->media.address); + media_address = &temp_media_address; + } else { + ast_debug(1, "Endpoint %s: RTP media address invalid: %s\n", + ast_sorcery_object_get_id(session->endpoint), + session->endpoint->media.address); + } } else { struct ast_sip_transport *transport = ast_sorcery_retrieve_by_id(ast_sip_get_sorcery(), "transport", @@ -210,9 +218,14 @@ static int create_rtp(struct ast_sip_session *session, struct ast_sip_session_me char hoststr[PJ_INET6_ADDRSTRLEN]; pj_sockaddr_print(&transport->state->host, hoststr, sizeof(hoststr), 0); - ast_debug(1, "Transport: %s bound to host: %s, using this for media.\n", - session->endpoint->transport, hoststr); - ast_sockaddr_parse(media_address, hoststr, 0); + if (ast_sockaddr_parse(&temp_media_address, hoststr, 0)) { + ast_debug(1, "Transport %s bound to %s: Using it for RTP media.\n", + session->endpoint->transport, hoststr); + media_address = &temp_media_address; + } else { + ast_debug(1, "Transport %s bound to %s: Invalid for RTP media.\n", + session->endpoint->transport, hoststr); + } } ao2_cleanup(transport); } -- 2.47.2