diff options
| author | Sean Bright <sean.bright@gmail.com> | 2017-12-12 16:19:09 -0500 |
|---|---|---|
| committer | Sean Bright <sean.bright@gmail.com> | 2017-12-12 15:35:08 -0600 |
| commit | d22bccef95193b8c5898e25212b1c0b97d3b95b9 (patch) | |
| tree | db3f7f8c684d9949ab657e0ff230c8e770c32386 | |
| parent | 0384e49a6e293ae27e98fafd2b593fbfa330847c (diff) | |
chan_sip: Don't crash in Dial on invalid destination
Stripping the DNID in a SIP dial string can result in attempting to call
the argument parsing macros on an empty string, causing a crash.
ASTERISK-26131 #close
Reported by: Dwayne Hubbard
Patches:
dw-asterisk-master-dnid-crash.patch (license #6257) patch
uploaded by Dwayne Hubbard
Change-Id: Ib84c1f740a9ec0539d582b09d847fc85ddca1c5e
| -rw-r--r-- | channels/chan_sip.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/channels/chan_sip.c b/channels/chan_sip.c index a6e5493c2..7b9cc6066 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -30554,6 +30554,14 @@ static struct ast_channel *sip_request_call(const char *type, struct ast_format_ } } + /* If stripping the DNID left us with nothing, bail out */ + if (ast_strlen_zero(tmp)) { + dialog_unlink_all(p); + dialog_unref(p, "unref dialog p from bad destination"); + *cause = AST_CAUSE_DESTINATION_OUT_OF_ORDER; + return NULL; + } + /* Divvy up the items separated by slashes */ AST_NONSTANDARD_APP_ARGS(args, tmp, '/'); |