chan_sip: Don't crash in Dial on invalid destination
authorSean Bright <sean.bright@gmail.com>
Tue, 12 Dec 2017 21:19:09 +0000 (16:19 -0500)
committerSean Bright <sean.bright@gmail.com>
Tue, 12 Dec 2017 21:35:17 +0000 (15:35 -0600)
Stripping the DNID in a SIP dial string can result in attempting to call
the argument parsing macros on an empty string, causing a crash.

ASTERISK-26131 #close
Reported by: Dwayne Hubbard
Patches:
dw-asterisk-master-dnid-crash.patch (license #6257) patch
uploaded by Dwayne Hubbard

Change-Id: Ib84c1f740a9ec0539d582b09d847fc85ddca1c5e

channels/chan_sip.c

index a829e20..8d73bb2 100644 (file)
@@ -30715,6 +30715,14 @@ static struct ast_channel *sip_request_call(const char *type, struct ast_format_
                }
        }
 
+       /* If stripping the DNID left us with nothing, bail out */
+       if (ast_strlen_zero(tmp)) {
+               dialog_unlink_all(p);
+               dialog_unref(p, "unref dialog p from bad destination");
+               *cause = AST_CAUSE_DESTINATION_OUT_OF_ORDER;
+               return NULL;
+       }
+
        /* Divvy up the items separated by slashes */
        AST_NONSTANDARD_APP_ARGS(args, tmp, '/');