Ticket #718: Crash when handling incoming request without rport (thanks Norma Steveley and Seth Hinze for the report)

git-svn-id: http://svn.pjsip.org/repos/pjproject/trunk@2442 74dad513-b988-da41-8d7b-12977e46ad98

3 files changed, 69 insertions, 5 deletions

diff --git a/pjsip/src/pjsip/sip_transaction.c b/pjsip/src/pjsip/sip_transaction.c
index f99a1a44..5a6f7dc6 100644
--- a/pjsip/src/pjsip/sip_transaction.c
+++ b/pjsip/src/pjsip/sip_transaction.c
@@ -1376,6 +1376,9 @@ PJ_DEF(pj_status_t) pjsip_tsx_create_uas( pjsip_module *tsx_user,
 	pj_memcpy(&tsx->addr, &tsx->res_addr.addr, tsx->res_addr.addr_len);
 	tsx->addr_len = tsx->res_addr.addr_len;
 	tsx->is_reliable = PJSIP_TRANSPORT_IS_RELIABLE(tsx->transport);
+    } else {
+	tsx->is_reliable = 
+	    (tsx->res_addr.dst_host.flag & PJSIP_TRANSPORT_RELIABLE);
     }
 
 
@@ -2315,7 +2318,7 @@ static pj_status_t tsx_on_state_proceeding_uas( pjsip_transaction *tsx,
 		     */
 		    timeout = timeout_timer_val;
 		    
-		} else if (PJSIP_TRANSPORT_IS_RELIABLE(tsx->transport)==0) {
+		} else if (!tsx->is_reliable) {
 		    
 		    /* For non-INVITE, start timer J at 64*T1 for unreliable
 		     * transport.
@@ -2655,9 +2658,7 @@ static pj_status_t tsx_on_state_proceeding_uac(pjsip_transaction *tsx,
 
 	/* Start Timer D with TD/T4 timer if unreliable transport is used. */
 	/* Note: tsx->transport may be NULL! */
-	if ((tsx->transport && PJSIP_TRANSPORT_IS_RELIABLE(tsx->transport)==0)
-	    || ((tsx->transport_flag & PJSIP_TRANSPORT_RELIABLE) == 0)) 
-	{
+	if (!tsx->is_reliable) {
 	    if (tsx->method.id == PJSIP_INVITE_METHOD) {
 		timeout = td_timer_val;
 	    } else {
@@ -2722,7 +2723,7 @@ static pj_status_t tsx_on_state_completed_uas( pjsip_transaction *tsx,
 	    /* Timer I is T4 timer for unreliable transports, and
 	     * zero seconds for reliable transports.
 	     */
-	    if (PJSIP_TRANSPORT_IS_RELIABLE(tsx->transport)==0) {
+	    if (!tsx->is_reliable) {
 		timeout.sec = 0; 
 		timeout.msec = 0;
 	    } else {
diff --git a/tests/pjsua/scripts-sendto/159_no_rport.py b/tests/pjsua/scripts-sendto/159_no_rport.py
new file mode 100644
index 00000000..d34e4a9d
--- /dev/null
+++ b/tests/pjsua/scripts-sendto/159_no_rport.py
@@ -0,0 +1,38 @@
+# $Id$
+import inc_sip as sip
+import inc_sdp as sdp
+
+# Ticket http://trac.pjsip.org/repos/ticket/718
+# RTC doesn't put rport in Via, and it is report to have caused segfault.
+complete_msg = \
+"""INVITE sip:localhost SIP/2.0
+Via: SIP/2.0/UDP $LOCAL_IP:$LOCAL_PORT;branch=z9hG4bK74a60ee5
+From: <sip:tester@localhost>;tag=as2858a32c
+To: <sip:pjsua@localhost>
+Contact: <sip:tester@$LOCAL_IP:$LOCAL_PORT>
+Call-ID: 123@localhost
+CSeq: 1 INVITE
+Max-Forwards: 70
+Content-Type: application/sdp
+Content-Length: 285
+
+v=0
+o=root 4236 4236 IN IP4 192.168.1.11
+s=session
+c=IN IP4 192.168.1.11
+t=0 0
+m=audio 14390 RTP/AVP 0 3 8 101
+a=rtpmap:0 PCMU/8000
+a=rtpmap:3 GSM/8000
+a=rtpmap:8 PCMA/8000
+a=rtpmap:101 telephone-event/8000
+a=fmtp:101 0-16
+a=silenceSupp:off - - - -
+a=ptime:20
+a=sendrecv
+"""
+
+
+sendto_cfg = sip.SendtoCfg( "RTC no rport", "--null-audio --auto-answer 200", 
+			    "", 200, complete_msg=complete_msg)
+
diff --git a/tests/pjsua/scripts-sendto/159_no_rport_nit.py b/tests/pjsua/scripts-sendto/159_no_rport_nit.py
new file mode 100644
index 00000000..2af9ab1a
--- /dev/null
+++ b/tests/pjsua/scripts-sendto/159_no_rport_nit.py
@@ -0,0 +1,25 @@
+# $Id$
+import inc_sip as sip
+import inc_sdp as sdp
+
+# Ticket http://trac.pjsip.org/repos/ticket/718
+# RTC doesn't put rport in Via, and it is reported to have caused segfault.
+#
+complete_msg = \
+"""MESSAGE sip:localhost SIP/2.0
+Via: SIP/2.0/UDP localhost:$LOCAL_PORT;branch=z9hG4bK$BRANCH
+From: <sip:tester@localhost>;tag=as2858a32c
+To: <sip:pjsua@localhost>
+Call-ID: 123@localhost
+CSeq: 1 MESSAGE
+Max-Forwards: 70
+Content-Length: 11
+Content-Type: text/plain
+
+Hello world
+"""
+
+
+sendto_cfg = sip.SendtoCfg( "RTC no rport", "--null-audio --auto-answer 200", 
+			    "", 200, complete_msg=complete_msg)
+