chan_mgcp: Properly handle malformed media lines

This corrects a situation in which a media line was not parsed properly
and resulted in a crash.

(closes issue ASTERISK-21190)
Reported by: adomjan
Patches:
    chan_mgcp.c-sscnaf_fix uploaded by adomjan (License 5448)

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@401537 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_mgcp.c b/channels/chan_mgcp.c
index 01188ae1ecafc3f968fc20f8b6bf85ceee27285d..972cb40e855cda961fdfe3791c5cbaec6fe91fef 100644 (file)
--- a/channels/chan_mgcp.c
+++ b/channels/chan_mgcp.c
@@ -1958,7 +1958,7 @@ static int process_sdp(struct mgcp_subchannel *sub, struct mgcp_request *req)
        char *c;
        char *a;
        char host[258];
-       int len;
+       int len = 0;
        int portno;
        format_t peercapability;
        int peerNonCodecCapability;
@@ -1988,8 +1988,8 @@ static int process_sdp(struct mgcp_subchannel *sub, struct mgcp_request *req)
                ast_log(LOG_WARNING, "Unable to lookup host in c= line, '%s'\n", c);
                return -1;
        }
-       if (sscanf(m, "audio %30d RTP/AVP %n", &portno, &len) != 1) {
-               ast_log(LOG_WARNING, "Unable to determine port number for RTP in '%s'\n", m);
+       if (sscanf(m, "audio %30d RTP/AVP %n", &portno, &len) != 1 || !len) {
+               ast_log(LOG_WARNING, "Malformed media stream descriptor: %s\n", m);
                return -1;
        }
        sin.sin_family = AF_INET;