diff options
| author | Sean Bright <sean.bright@gmail.com> | 2017-12-12 16:19:09 -0500 |
|---|---|---|
| committer | Sean Bright <sean.bright@gmail.com> | 2017-12-12 16:23:23 -0500 |
| commit | ce2c89ce6847339d7a14169ba769f955118aa6b0 (patch) | |
| tree | d82ce7a5f2816e8bbfab79eb17c69313c379c091 /channels | |
| parent | 28eddc7ea64094f18661c5a092e27c3f7bb19032 (diff) | |
chan_sip: Don't crash in Dial on invalid destination
Stripping the DNID in a SIP dial string can result in attempting to call
the argument parsing macros on an empty string, causing a crash.
ASTERISK-26131 #close
Reported by: Dwayne Hubbard
Patches:
dw-asterisk-master-dnid-crash.patch (license #6257) patch
uploaded by Dwayne Hubbard
Change-Id: Ib84c1f740a9ec0539d582b09d847fc85ddca1c5e
Diffstat (limited to 'channels')
| -rw-r--r-- | channels/chan_sip.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/channels/chan_sip.c b/channels/chan_sip.c index b8cc7bf76..b1a8de5f2 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -30465,6 +30465,17 @@ static struct ast_channel *sip_request_call(const char *type, struct ast_format_ ast_string_field_set(p, todnid, dnid); } + /* If stripping the DNID left us with nothing, bail out */ + if (ast_strlen_zero(tmp)) { + dialog_unlink_all(p); + dialog_unref(p, "unref dialog p from bad destination"); + *cause = AST_CAUSE_DESTINATION_OUT_OF_ORDER; + if (callid) { + ast_callid_unref(callid); + } + return NULL; + } + /* Divvy up the items separated by slashes */ AST_NONSTANDARD_APP_ARGS(args, tmp, '/'); |