Merged revisions 160297 via svnmerge from

https://origsvn.digium.com/svn/asterisk/branches/1.4

........
  r160297 | tilghman | 2008-12-02 11:42:09 -0600 (Tue, 02 Dec 2008) | 10 lines

  When the text does not match exactly (e.g. RTP/SAVP), then the %n conversion
  fails, and the resulting integer is garbage.  Thus, we must initialize the
  integer and check it afterwards for success.
  (closes issue #14000)
   Reported by: folke
   Patches:
         asterisk-sipbg-sscanf-1.4.22.diff uploaded by folke (license 626)
         asterisk-sipbg-sscanf-1.6.0.1.diff uploaded by folke (license 626)
         asterisk-sipbg-sscanf-trunk-r159896.diff uploaded by folke (license 626)
........

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@160308 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index a60efc5..d345d9e 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -7378,8 +7378,9 @@ static int process_sdp(struct sip_pvt *p, struct sip_request *req, int t38action
                int text = FALSE;
 
                numberofports = 1;
-               if ((sscanf(m, "audio %d/%d RTP/AVP %n", &x, &numberofports, &len) == 2) ||
-                   (sscanf(m, "audio %d RTP/AVP %n", &x, &len) == 1)) {
+               len = -1;
+               if ((sscanf(m, "audio %d/%d RTP/AVP %n", &x, &numberofports, &len) == 2 && len > 0) ||
+                   (sscanf(m, "audio %d RTP/AVP %n", &x, &len) == 1 && len > 0)) {
                        audio = TRUE;
                        numberofmediastreams++;
                        /* Found audio stream in this media definition */
@@ -7394,8 +7395,8 @@ static int process_sdp(struct sip_pvt *p, struct sip_request *req, int t38action
                                        ast_verbose("Found RTP audio format %d\n", codec);
                                ast_rtp_set_m_type(newaudiortp, codec);
                        }
-               } else if ((sscanf(m, "video %d/%d RTP/AVP %n", &x, &numberofports, &len) == 2) ||
-                   (sscanf(m, "video %d RTP/AVP %n", &x, &len) == 1)) {
+               } else if ((sscanf(m, "video %d/%d RTP/AVP %n", &x, &numberofports, &len) == 2 && len > 0) ||
+                   (sscanf(m, "video %d RTP/AVP %n", &x, &len) == 1 && len >= 0)) {
                        video = TRUE;
                        p->novideo = FALSE;
                        numberofmediastreams++;
@@ -7410,8 +7411,8 @@ static int process_sdp(struct sip_pvt *p, struct sip_request *req, int t38action
                                        ast_verbose("Found RTP video format %d\n", codec);
                                ast_rtp_set_m_type(newvideortp, codec);
                        }
-               } else if ((sscanf(m, "text %d/%d RTP/AVP %n", &x, &numberofports, &len) == 2) ||
-                   (sscanf(m, "text %d RTP/AVP %n", &x, &len) == 1)) {
+               } else if ((sscanf(m, "text %d/%d RTP/AVP %n", &x, &numberofports, &len) == 2 && len > 0) ||
+                   (sscanf(m, "text %d RTP/AVP %n", &x, &len) == 1 && len > 0)) {
                        text = TRUE;
                        p->notext = FALSE;
                        numberofmediastreams++;
@@ -7426,8 +7427,8 @@ static int process_sdp(struct sip_pvt *p, struct sip_request *req, int t38action
                                        ast_verbose("Found RTP text format %d\n", codec);
                                ast_rtp_set_m_type(newtextrtp, codec);
                        }
-               } else if (p->udptl && ( (sscanf(m, "image %d udptl t38%n", &x, &len) == 1) || 
-                (sscanf(m, "image %d UDPTL t38%n", &x, &len) == 1) )) {
+               } else if (p->udptl && ( (sscanf(m, "image %d udptl t38%n", &x, &len) == 1 && len > 0) || 
+                       (sscanf(m, "image %d UDPTL t38%n", &x, &len) == 1 && len > 0) )) {
                        if (debug)
                                ast_verbose("Got T.38 offer in SDP in dialog %s\n", p->callid);
                        udptlportno = x;