From d22bccef95193b8c5898e25212b1c0b97d3b95b9 Mon Sep 17 00:00:00 2001 From: Sean Bright Date: Tue, 12 Dec 2017 16:19:09 -0500 Subject: chan_sip: Don't crash in Dial on invalid destination Stripping the DNID in a SIP dial string can result in attempting to call the argument parsing macros on an empty string, causing a crash. ASTERISK-26131 #close Reported by: Dwayne Hubbard Patches: dw-asterisk-master-dnid-crash.patch (license #6257) patch uploaded by Dwayne Hubbard Change-Id: Ib84c1f740a9ec0539d582b09d847fc85ddca1c5e --- channels/chan_sip.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/channels/chan_sip.c b/channels/chan_sip.c index a6e5493c2..7b9cc6066 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -30554,6 +30554,14 @@ static struct ast_channel *sip_request_call(const char *type, struct ast_format_ } } + /* If stripping the DNID left us with nothing, bail out */ + if (ast_strlen_zero(tmp)) { + dialog_unlink_all(p); + dialog_unref(p, "unref dialog p from bad destination"); + *cause = AST_CAUSE_DESTINATION_OUT_OF_ORDER; + return NULL; + } + /* Divvy up the items separated by slashes */ AST_NONSTANDARD_APP_ARGS(args, tmp, '/'); -- cgit v1.2.3