diff options
| author | Sean Bright <sean.bright@gmail.com> | 2017-12-12 16:19:09 -0500 |
|---|---|---|
| committer | Sean Bright <sean.bright@gmail.com> | 2017-12-12 15:35:17 -0600 |
| commit | 5039b5741c46a155cc988def618276e88099b73d (patch) | |
| tree | 509ceb8ada6e29a17c114b37d0cf12df607454a1 /channels | |
| parent | c2ec82bf36b66b758f968c8d62865705c351a280 (diff) | |
chan_sip: Don't crash in Dial on invalid destination
Stripping the DNID in a SIP dial string can result in attempting to call
the argument parsing macros on an empty string, causing a crash.
ASTERISK-26131 #close
Reported by: Dwayne Hubbard
Patches:
dw-asterisk-master-dnid-crash.patch (license #6257) patch
uploaded by Dwayne Hubbard
Change-Id: Ib84c1f740a9ec0539d582b09d847fc85ddca1c5e
Diffstat (limited to 'channels')
| -rw-r--r-- | channels/chan_sip.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/channels/chan_sip.c b/channels/chan_sip.c index a829e2039..8d73bb25a 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -30715,6 +30715,14 @@ static struct ast_channel *sip_request_call(const char *type, struct ast_format_ } } + /* If stripping the DNID left us with nothing, bail out */ + if (ast_strlen_zero(tmp)) { + dialog_unlink_all(p); + dialog_unref(p, "unref dialog p from bad destination"); + *cause = AST_CAUSE_DESTINATION_OUT_OF_ORDER; + return NULL; + } + /* Divvy up the items separated by slashes */ AST_NONSTANDARD_APP_ARGS(args, tmp, '/'); |