diff options
author | Benny Prijono <bennylp@teluu.com> | 2009-10-01 12:07:04 +0000 |
---|---|---|
committer | Benny Prijono <bennylp@teluu.com> | 2009-10-01 12:07:04 +0000 |
commit | 7e439d29f58acfe82c326f1d9bade56b27fb2391 (patch) | |
tree | 96b804dd800be4e0372153a5a70d33380a04616a /pjsip | |
parent | 5bde52b2f543523aa17ee2dc102d09134cf846cb (diff) |
Ticket #961 (1.4.5 branch): Assertion upon receiving malformed SIP messages (thanks Andrey Kovalenko for the report)
- backported r2915
git-svn-id: http://svn.pjsip.org/repos/pjproject/branches/adhocs/1.4.5@2921 74dad513-b988-da41-8d7b-12977e46ad98
Diffstat (limited to 'pjsip')
-rw-r--r-- | pjsip/src/pjsip/sip_transaction.c | 9 | ||||
-rw-r--r-- | pjsip/src/pjsip/sip_transport.c | 8 |
2 files changed, 17 insertions, 0 deletions
diff --git a/pjsip/src/pjsip/sip_transaction.c b/pjsip/src/pjsip/sip_transaction.c index 7008670a..e7e2347b 100644 --- a/pjsip/src/pjsip/sip_transaction.c +++ b/pjsip/src/pjsip/sip_transaction.c @@ -2840,6 +2840,15 @@ static pj_status_t tsx_on_state_completed_uas( pjsip_transaction *tsx, /* Process incoming ACK request. */ + /* Verify that this is an INVITE transaction */ + if (tsx->method.id != PJSIP_INVITE_METHOD) { + PJ_LOG(2, (tsx->obj_name, + "Received illegal ACK for %.*s transaction", + (int)tsx->method.name.slen, + tsx->method.name.ptr)); + return PJSIP_EINVALIDMETHOD; + } + /* Cease retransmission. */ if (tsx->retransmit_timer.id != 0) { pjsip_endpt_cancel_timer(tsx->endpt, &tsx->retransmit_timer); diff --git a/pjsip/src/pjsip/sip_transport.c b/pjsip/src/pjsip/sip_transport.c index f34699be..b6e79183 100644 --- a/pjsip/src/pjsip/sip_transport.c +++ b/pjsip/src/pjsip/sip_transport.c @@ -1439,6 +1439,14 @@ PJ_DEF(pj_ssize_t) pjsip_tpmgr_receive_packet( pjsip_tpmgr *mgr, if (rdata->msg_info.via->rport_param == 0) { rdata->msg_info.via->rport_param = rdata->pkt_info.src_port; } + } else { + /* Drop malformed responses */ + if (rdata->msg_info.msg->line.status.code < 100 || + rdata->msg_info.msg->line.status.code >= 700) + { + mgr->on_rx_msg(mgr->endpt, PJSIP_EINVALIDSTATUS, rdata); + goto finish_process_fragment; + } } /* Drop response message if it has more than one Via. |