Check cur value before attempting a deref.

(closes issue #17775)
 Reported by: svinson
 Patches:
       20100804__issue17775.diff.txt uploaded by tilghman (license 14)
 Tested by: svinson

(closes issue #17743)
 Reported by: tgruenberg
 Patches:
       20100804__issue17775.diff.txt uploaded by tilghman (license 14)
 Tested by: tgruenberg

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@280879 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_mgcp.c b/channels/chan_mgcp.c
index 485b39aade22bcffcc3fd0c9baf1f7fbe96c2282..a787eab7207e97d2eb6af601deb4937cef9805f9 100644 (file)
--- a/channels/chan_mgcp.c
+++ b/channels/chan_mgcp.c
@@ -3580,7 +3580,7 @@ static int find_and_retrans(struct mgcp_subchannel *sub, struct mgcp_request *re
        if (sscanf(req->identifier, "%30d", &seqno) != 1) {
                seqno = 0;
        }
-       for (cur = sub->parent->parent->responses, next = cur->next; cur; cur = next, next = cur->next) {
+       for (cur = sub->parent->parent->responses, next = cur ? cur->next : NULL; cur; cur = next, next = cur ? cur->next : NULL) {
                if (now - cur->whensent > RESPONSE_TIMEOUT) {
                        /* Delete this entry */
                        if (prev)