sr-dev April 2013

sr-dev@lists.kamailio.org

38 participants
401 discussions

git:4.0: xcap_server: init etag variable for PUT operations

by Juha Heinanen

Module: sip-router Branch: 4.0 Commit: c7ef60e6c960c029b49bca01a89498a5dcdeec19 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=c7ef60e… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Juha Heinanen <jh(a)tutpro.com> Date: Sat Apr 13 11:26:48 2013 +0200 xcap_server: init etag variable for PUT operations - the function xcaps_get_db_etag() may not found a record to db and will not initialize it, resulting in bogus value passed to check_preconditions() - reported by Juha Heinanen, FS#283 (cherry picked from commit 2d27dd1080cd490e93646b38d3912dcbe3761ca5) --- modules/xcap_server/xcap_server.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/xcap_server/xcap_server.c b/modules/xcap_server/xcap_server.c index 24e3269..8bc14eb 100644 --- a/modules/xcap_server/xcap_server.c +++ b/modules/xcap_server/xcap_server.c @@ -506,8 +506,8 @@ static int w_xcaps_put(sip_msg_t* msg, char* puri, char* ppath, str uri; str path; str body = {0, 0}; - str etag; - str etag_hdr; + str etag = {0, 0}; + str etag_hdr = {0, 0}; str tbuf; str nbuf = {0, 0}; str allow = {0, 0}; @@ -1069,7 +1069,7 @@ static int w_xcaps_get(sip_msg_t* msg, char* puri, char* ppath) struct sip_uri turi; str uri; str path; - str etag; + str etag = {0, 0}; str body; int ret = 0; xcap_uri_t xuri;

11 years, 9 months

[tracker] Task closed: xcap_server crash

by sip-router

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY. The following task is now closed: FS#283 - xcap_server crash User who did this - Daniel-Constantin Mierla (miconda) Reason for closing: Fixed Additional comments about closing: Should be fixed by GIT#2d27dd1080cd490e93646b38d3912dcbe3761ca5 More information can be found at the following URL: http://sip-router.org/tracker/index.php?do=details&task_id=283 You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.

11 years, 9 months

new warning

by Juha Heinanen

i got this warning on debian wheezy while building ctl command on master: parse_listen_id.c: In function 'str2s': parse_listen_id.c:66:17: warning: variable 'init' set but not used [-Wunused-but-set-variable] that i don't remember seeing it before, but may be i was not looking. -- juha

11 years, 9 months

git:master: xcap_server: init etag variable for PUT operations

by Daniel-Constantin Mierla

Module: sip-router Branch: master Commit: 2d27dd1080cd490e93646b38d3912dcbe3761ca5 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=2d27dd1… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: Sat Apr 13 11:26:48 2013 +0200 xcap_server: init etag variable for PUT operations - the function xcaps_get_db_etag() may not found a record to db and will not initialize it, resulting in bogus value passed to check_preconditions() - reported by Juha Heinanen, FS#283 --- modules/xcap_server/xcap_server.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/xcap_server/xcap_server.c b/modules/xcap_server/xcap_server.c index 24e3269..8bc14eb 100644 --- a/modules/xcap_server/xcap_server.c +++ b/modules/xcap_server/xcap_server.c @@ -506,8 +506,8 @@ static int w_xcaps_put(sip_msg_t* msg, char* puri, char* ppath, str uri; str path; str body = {0, 0}; - str etag; - str etag_hdr; + str etag = {0, 0}; + str etag_hdr = {0, 0}; str tbuf; str nbuf = {0, 0}; str allow = {0, 0}; @@ -1069,7 +1069,7 @@ static int w_xcaps_get(sip_msg_t* msg, char* puri, char* ppath) struct sip_uri turi; str uri; str path; - str etag; + str etag = {0, 0}; str body; int ret = 0; xcap_uri_t xuri;

11 years, 9 months

duplicate ruid_idx entry

by Juha Heinanen

i have in usrloc memory a single AOR that has two contacts with the same ruid: sip-proxy_ctl mi ul_dump | grep -E -i -w 'AOR|Ruid' AOR:: jh(a)test.fi Ruid:: uloc-516852e9-1a18-1 Ruid:: ulcx-516852e9-1a16-1 Ruid:: ulcx-516852e9-1a16-1 in location table is it not possible because of this: <index> <name>ruid_idx</name> <colref linkend="ruid"/> <unique/> </index> as result, i'm getting these kind of errors to syslog: Apr 13 10:48:40 siika /usr/sbin/sip-proxy[6704]: ERROR: db_mysql [km_dbase.c:122]: driver error on query: Duplicate entry 'ulcx-516852e9-1a16-1' for key 'ruid_idx' Apr 13 10:48:40 siika /usr/sbin/sip-proxy[6704]: ERROR: <core> [db_query.c:235]: error while submitting query Apr 13 10:48:40 siika /usr/sbin/sip-proxy[6704]: ERROR: usrloc [ucontact.c:615]: inserting contact in db failed Apr 13 10:48:40 siika /usr/sbin/sip-proxy[6704]: ERROR: usrloc [urecord.c:352]: inserting contact into database failed this happened while i was doing tests with master, but may be this bug already exists in 4.0. how is it possible that memory usrloc has two contacts with same ruid? -- juha

11 years, 9 months

is_supported?

by Juha Heinanen

parser has parse_supported function that produces a bitmap of all supported options. based on that it would be quite easy to implement is_supported(option) function. however, i was not able to find such a function. is there one? if not, i could try to implement it. -- juha

11 years, 9 months

git:4.0: db_mysql: fix segfault when recursive queries are made

by Richard Fuchs

Module: sip-router Branch: 4.0 Commit: 5e5ba673fa4d2351047eadeaec655017c962424d URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=5e5ba67… Author: Richard Fuchs <rfuchs(a)sipwise.com> Committer: Richard Fuchs <rfuchs(a)sipwise.com> Date: Wed Apr 10 09:34:49 2013 -0400 db_mysql: fix segfault when recursive queries are made The MySQL result object (MYSQL_RES) should not be stored within the srdb1 connection object, but rather within the srdb1 result object. Otherwise recursive queries overwrite each other's result sets, which results in segfault. Conflicts: modules/db_mysql/km_my_con.h --- modules/db_mysql/km_dbase.c | 36 +++++++++++++++++++----------------- modules/db_mysql/km_dbase.h | 2 +- modules/db_mysql/km_my_con.c | 1 - modules/db_mysql/km_my_con.h | 4 ---- modules/db_mysql/km_res.c | 27 +++++++++++++++++++++++---- modules/db_mysql/km_res.h | 19 +++++++++++++++++++ modules/db_mysql/km_row.c | 5 +++-- 7 files changed, 65 insertions(+), 29 deletions(-) diff --git a/modules/db_mysql/km_dbase.c b/modules/db_mysql/km_dbase.c index e1cce08..151a24a 100644 --- a/modules/db_mysql/km_dbase.c +++ b/modules/db_mysql/km_dbase.c @@ -163,14 +163,14 @@ static int db_mysql_store_result(const db1_con_t* _h, db1_res_t** _r) return -1; } - *_r = db_new_result(); + *_r = db_mysql_new_result(); if (*_r == 0) { LM_ERR("no memory left\n"); return -2; } - CON_RESULT(_h) = mysql_store_result(CON_CONNECTION(_h)); - if (!CON_RESULT(_h)) { + RES_RESULT(*_r) = mysql_store_result(CON_CONNECTION(_h)); + if (!RES_RESULT(*_r)) { if (mysql_field_count(CON_CONNECTION(_h)) == 0) { (*_r)->col.n = 0; (*_r)->n = 0; @@ -181,7 +181,7 @@ static int db_mysql_store_result(const db1_con_t* _h, db1_res_t** _r) if (code == CR_SERVER_GONE_ERROR || code == CR_SERVER_LOST) { counter_inc(mysql_cnts_h.driver_err); } - db_free_result(*_r); + db_mysql_free_result(_h, *_r); *_r = 0; return -3; } @@ -195,14 +195,14 @@ static int db_mysql_store_result(const db1_con_t* _h, db1_res_t** _r) /* all mem on Kamailio API side is already freed by * db_mysql_convert_result in case of error, but we also need * to free the mem from the mysql lib side */ - mysql_free_result(CON_RESULT(_h)); + mysql_free_result(RES_RESULT(*_r)); #if (MYSQL_VERSION_ID >= 40100) while( mysql_more_results(CON_CONNECTION(_h)) && mysql_next_result(CON_CONNECTION(_h)) > 0 ) { MYSQL_RES *res = mysql_store_result( CON_CONNECTION(_h) ); mysql_free_result(res); } #endif - CON_RESULT(_h) = 0; + RES_RESULT(*_r) = 0; return -4; } @@ -224,19 +224,21 @@ done: * \param _r result set that should be freed * \return zero on success, negative value on failure */ -int db_mysql_free_result(db1_con_t* _h, db1_res_t* _r) +int db_mysql_free_result(const db1_con_t* _h, db1_res_t* _r) { if ((!_h) || (!_r)) { LM_ERR("invalid parameter value\n"); return -1; } + mysql_free_result(RES_RESULT(_r)); + RES_RESULT(_r) = 0; + pkg_free(RES_PTR(_r)); + if (db_free_result(_r) < 0) { LM_ERR("unable to free result structure\n"); return -1; } - mysql_free_result(CON_RESULT(_h)); - CON_RESULT(_h) = 0; return 0; } @@ -288,21 +290,21 @@ int db_mysql_fetch_result(const db1_con_t* _h, db1_res_t** _r, const int nrows) /* exit if the fetch count is zero */ if (nrows == 0) { - db_free_result(*_r); + db_mysql_free_result(_h, *_r); *_r = 0; return 0; } if(*_r==0) { /* Allocate a new result structure */ - *_r = db_new_result(); + *_r = db_mysql_new_result(); if (*_r == 0) { LM_ERR("no memory left\n"); return -2; } - CON_RESULT(_h) = mysql_store_result(CON_CONNECTION(_h)); - if (!CON_RESULT(_h)) { + RES_RESULT(*_r) = mysql_store_result(CON_CONNECTION(_h)); + if (!RES_RESULT(*_r)) { if (mysql_field_count(CON_CONNECTION(_h)) == 0) { (*_r)->col.n = 0; (*_r)->n = 0; @@ -313,7 +315,7 @@ int db_mysql_fetch_result(const db1_con_t* _h, db1_res_t** _r, const int nrows) if (code == CR_SERVER_GONE_ERROR || code == CR_SERVER_LOST) { counter_inc(mysql_cnts_h.driver_err); } - db_free_result(*_r); + db_mysql_free_result(_h, *_r); *_r = 0; return -3; } @@ -323,7 +325,7 @@ int db_mysql_fetch_result(const db1_con_t* _h, db1_res_t** _r, const int nrows) return -4; } - RES_NUM_ROWS(*_r) = mysql_num_rows(CON_RESULT(_h)); + RES_NUM_ROWS(*_r) = mysql_num_rows(RES_RESULT(*_r)); if (!RES_NUM_ROWS(*_r)) { LM_DBG("no rows returned from the query\n"); RES_ROWS(*_r) = 0; @@ -362,8 +364,8 @@ int db_mysql_fetch_result(const db1_con_t* _h, db1_res_t** _r, const int nrows) } for(i = 0; i < rows; i++) { - CON_ROW(_h) = mysql_fetch_row(CON_RESULT(_h)); - if (!CON_ROW(_h)) { + RES_ROW(*_r) = mysql_fetch_row(RES_RESULT(*_r)); + if (!RES_ROW(*_r)) { LM_ERR("driver error: %s\n", mysql_error(CON_CONNECTION(_h))); RES_ROW_N(*_r) = i; db_free_rows(*_r); diff --git a/modules/db_mysql/km_dbase.h b/modules/db_mysql/km_dbase.h index 3a567f2..2acf517 100644 --- a/modules/db_mysql/km_dbase.h +++ b/modules/db_mysql/km_dbase.h @@ -57,7 +57,7 @@ void db_mysql_close(db1_con_t* _h); /*! \brief * Free all memory allocated by get_result */ -int db_mysql_free_result(db1_con_t* _h, db1_res_t* _r); +int db_mysql_free_result(const db1_con_t* _h, db1_res_t* _r); /*! \brief diff --git a/modules/db_mysql/km_my_con.c b/modules/db_mysql/km_my_con.c index ce20be2..646d74b 100644 --- a/modules/db_mysql/km_my_con.c +++ b/modules/db_mysql/km_my_con.c @@ -144,7 +144,6 @@ void db_mysql_free_connection(struct pool_con* con) _c = (struct my_con*) con; - if (_c->res) mysql_free_result(_c->res); if (_c->id) free_db_id(_c->id); if (_c->con) { mysql_close(_c->con); diff --git a/modules/db_mysql/km_my_con.h b/modules/db_mysql/km_my_con.h index 2624f34..3d71d00 100644 --- a/modules/db_mysql/km_my_con.h +++ b/modules/db_mysql/km_my_con.h @@ -44,9 +44,7 @@ struct my_con { unsigned int ref; /*!< Reference count */ struct pool_con* next; /*!< Next connection in the pool */ - MYSQL_RES* res; /*!< Actual result */ MYSQL* con; /*!< Connection representation */ - MYSQL_ROW row; /*!< Actual row in the result */ time_t timestamp; /*!< Timestamp of last query */ }; @@ -54,9 +52,7 @@ struct my_con { /* * Some convenience wrappers */ -#define CON_RESULT(db_con) (((struct my_con*)((db_con)->tail))->res) #define CON_CONNECTION(db_con) (((struct my_con*)((db_con)->tail))->con) -#define CON_ROW(db_con) (((struct my_con*)((db_con)->tail))->row) #define CON_TIMESTAMP(db_con) (((struct my_con*)((db_con)->tail))->timestamp) diff --git a/modules/db_mysql/km_res.c b/modules/db_mysql/km_res.c index 10d3ce2..965e6dc 100644 --- a/modules/db_mysql/km_res.c +++ b/modules/db_mysql/km_res.c @@ -73,7 +73,7 @@ int db_mysql_get_columns(const db1_con_t* _h, db1_res_t* _r) return -3; } - fields = mysql_fetch_fields(CON_RESULT(_h)); + fields = mysql_fetch_fields(RES_RESULT(_r)); for(col = 0; col < RES_COL_N(_r); col++) { RES_NAMES(_r)[col] = (str*)pkg_malloc(sizeof(str)); if (! RES_NAMES(_r)[col]) { @@ -164,7 +164,7 @@ static inline int db_mysql_convert_rows(const db1_con_t* _h, db1_res_t* _r) return -1; } - RES_ROW_N(_r) = mysql_num_rows(CON_RESULT(_h)); + RES_ROW_N(_r) = mysql_num_rows(RES_RESULT(_r)); if (!RES_ROW_N(_r)) { LM_DBG("no rows returned from the query\n"); RES_ROWS(_r) = 0; @@ -177,8 +177,8 @@ static inline int db_mysql_convert_rows(const db1_con_t* _h, db1_res_t* _r) } for(row = 0; row < RES_ROW_N(_r); row++) { - CON_ROW(_h) = mysql_fetch_row(CON_RESULT(_h)); - if (!CON_ROW(_h)) { + RES_ROW(_r) = mysql_fetch_row(RES_RESULT(_r)); + if (!RES_ROW(_r)) { LM_ERR("driver error: %s\n", mysql_error(CON_CONNECTION(_h))); RES_ROW_N(_r) = row; db_free_rows(_r); @@ -221,3 +221,22 @@ int db_mysql_convert_result(const db1_con_t* _h, db1_res_t* _r) return 0; } + +/*! + * \brief Allocate new result set with private structure + * \return db1_res_t object on success, NULL on failure + */ +db1_res_t* db_mysql_new_result(void) +{ + db1_res_t* obj; + + obj = db_new_result(); + if (!obj) + return NULL; + RES_PTR(obj) = pkg_malloc(sizeof(struct my_res)); + if (!RES_PTR(obj)) { + db_free_result(obj); + return NULL; + } + return obj; +} diff --git a/modules/db_mysql/km_res.h b/modules/db_mysql/km_res.h index 957a961..0b063d8 100644 --- a/modules/db_mysql/km_res.h +++ b/modules/db_mysql/km_res.h @@ -37,6 +37,18 @@ #include "../../lib/srdb1/db_con.h" +struct my_res { + MYSQL_RES* res; /*!< Actual result */ + MYSQL_ROW row; /*!< Actual row in the result */ +}; + +/* + * Some convenience wrappers + */ +#define RES_RESULT(db_res) (((struct my_res*)((db_res)->ptr))->res) +#define RES_ROW(db_res) (((struct my_res*)((db_res)->ptr))->row) + + /*! * \brief Fill the result structure with data from database * \param _h database connection @@ -54,4 +66,11 @@ int db_mysql_convert_result(const db1_con_t* _h, db1_res_t* _r); */ int db_mysql_get_columns(const db1_con_t* _h, db1_res_t* _r); + +/*! + * \brief Allocate new result set with private structure + * \return db1_res_t object on success, NULL on failure + */ +db1_res_t* db_mysql_new_result(void); + #endif diff --git a/modules/db_mysql/km_row.c b/modules/db_mysql/km_row.c index 42f2841..9f2c730 100644 --- a/modules/db_mysql/km_row.c +++ b/modules/db_mysql/km_row.c @@ -36,6 +36,7 @@ #include "km_my_con.h" #include "km_val.h" #include "km_row.h" +#include "km_res.h" /*! * \brief Convert a row from result into DB API representation @@ -59,11 +60,11 @@ int db_mysql_convert_row(const db1_con_t* _h, db1_res_t* _res, db_row_t* _r) return -2; } - lengths = mysql_fetch_lengths(CON_RESULT(_h)); + lengths = mysql_fetch_lengths(RES_RESULT(_res)); for(i = 0; i < RES_COL_N(_res); i++) { if (db_str2val(RES_TYPES(_res)[i], &(ROW_VALUES(_r)[i]), - ((MYSQL_ROW)CON_ROW(_h))[i], lengths[i], 0) < 0) { + ((MYSQL_ROW)RES_ROW(_res))[i], lengths[i], 0) < 0) { LM_ERR("failed to convert value\n"); LM_DBG("free row at %p\n", _r); db_free_row(_r);

11 years, 9 months

git:4.0: srdb1: add new db-private generic pointer to struct db1_res

by Richard Fuchs

Module: sip-router Branch: 4.0 Commit: 5ba5a0a5bb6fc5080604e1abaef6cd41148911de URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=5ba5a0a… Author: Richard Fuchs <rfuchs(a)sipwise.com> Committer: Richard Fuchs <rfuchs(a)sipwise.com> Date: Wed Apr 10 09:33:53 2013 -0400 srdb1: add new db-private generic pointer to struct db1_res --- lib/srdb1/db_res.h | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/lib/srdb1/db_res.h b/lib/srdb1/db_res.h index f8f909f..62fc11c 100644 --- a/lib/srdb1/db_res.h +++ b/lib/srdb1/db_res.h @@ -61,6 +61,7 @@ typedef struct db1_res { int n; /**< Number of rows in current fetch */ int res_rows; /**< Number of total rows in query */ int last_row; /**< Last row */ + void* ptr; /**< For use by DB modules */ } db1_res_t; @@ -78,6 +79,8 @@ typedef struct db1_res { #define RES_LAST_ROW(re) ((re)->last_row) /** Return the number of total result rows */ #define RES_NUM_ROWS(re) ((re)->res_rows) +/** Return the module-specific pointer */ +#define RES_PTR(re) ((re)->ptr) /**

11 years, 9 months

git:admorten/sca: modules/sca: clear appearance on t_reply with error after receiving 18x.

by Andrew Mortensen

Module: sip-router Branch: admorten/sca Commit: b906a1e4c3d36a8dd007dabd1934c7a625ffdd6a URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=b906a1e… Author: Andrew Mortensen <admorten(a)isc.upenn.edu> Committer: Andrew Mortensen <admorten(a)isc.upenn.edu> Date: Thu Apr 11 22:34:10 2013 -0400 modules/sca: clear appearance on t_reply with error after receiving 18x. - Receiving a 18x provisional reply triggers line-seize subscription termination. Releasing the seized appearance while processing a t_reply with an error status *after* getting a 18x would fail because sca_subscription_terminate could not find a matching line-seize subscription. In that case, look up appearance by tags and release it. --- modules/sca/sca_call_info.c | 33 ++++++++++++++++++++++++++++----- modules/sca/sca_subscribe.c | 8 +++++++- 2 files changed, 35 insertions(+), 6 deletions(-) diff --git a/modules/sca/sca_call_info.c b/modules/sca/sca_call_info.c index 8f681fd..6766553 100644 --- a/modules/sca/sca_call_info.c +++ b/modules/sca/sca_call_info.c @@ -877,8 +877,10 @@ sca_call_info_local_error_reply_handler( sip_msg_t *msg, int status ) { struct to_body *from; struct to_body *to; + sca_appearance *app; str aor = STR_NULL; str contact_uri = STR_NULL; + int rc; if ( sca_get_msg_from_header( msg, &from ) < 0 ) { LM_ERR( "sca_call_info_sl_reply_cb: failed to get From header from " @@ -909,15 +911,36 @@ sca_call_info_local_error_reply_handler( sip_msg_t *msg, int status ) return; } - if ( sca_subscription_terminate( sca, &aor, + /* + * two typical cases to handle. in the first case, we haven't dropped + * our line-seize subscription because a transaction exists but we + * never got a provisional 18x response before calling t_reply. calling + * sca_subscription_terminate will drop the subscription and release + * the seized appearance. + * + * in the second case, we got a 18x response and terminated the + * line-seize subscription, so we need to look up the appearance by + * tags in order to release it. + */ + rc = sca_subscription_terminate( sca, &aor, SCA_EVENT_TYPE_LINE_SEIZE, &contact_uri, SCA_SUBSCRIPTION_STATE_TERMINATED_NORESOURCE, - SCA_SUBSCRIPTION_TERMINATE_OPT_DEFAULT ) < 0 ) { + SCA_SUBSCRIPTION_TERMINATE_OPT_DEFAULT ); + if ( rc < 0 ) { LM_ERR( "sca_call_info_sl_reply_cb: failed to terminate " "line-seize subscription for %.*s", STR_FMT( &contact_uri )); - } else if ( sca_notify_call_info_subscribers( sca, &aor ) < 0 ) { - LM_ERR( "Failed to call-info NOTIFY %.*s subscribers", - STR_FMT( &aor )); + } else if ( rc == 0 ) { + /* no line-seize subscription found */ + app = sca_appearance_unlink_by_tags( sca, &aor, + &msg->callid->body, &from->tag_value, &to->tag_value ); + if ( app ) { + sca_appearance_free( app ); + if ( sca_notify_call_info_subscribers( sca, &aor ) < 0 ) { + LM_ERR( "sca_call_info_local_error_reply: failed to send " + "call-info NOTIFY to %.*s subscribers", + STR_FMT( &aor )); + } + } } } diff --git a/modules/sca/sca_subscribe.c b/modules/sca/sca_subscribe.c index f30386a..d62e7bf 100644 --- a/modules/sca/sca_subscribe.c +++ b/modules/sca/sca_subscribe.c @@ -1350,6 +1350,12 @@ sca_subscription_reply( sca_mod *scam, int status_code, char *status_msg, return( sca_reply( scam, status_code, status_msg, &extra_headers, msg )); } +/* + * return values: + * -1: error + * 0: no subscription found to terminate + * 1: subscription terminated + */ int sca_subscription_terminate( sca_mod *scam, str *aor, int event, str *subscriber, int termination_state, int opts ) @@ -1395,7 +1401,7 @@ sca_subscription_terminate( sca_mod *scam, str *aor, int event, if ( ent == NULL ) { LM_DBG( "No %s subscription for %.*s", event_name, STR_FMT( subscriber )); - return( 1 ); + return( 0 ); } sub = (sca_subscription *)ent->value;

11 years, 9 months

git:master: core: safety check for content-lenght size in tcp read

by Daniel-Constantin Mierla

Module: sip-router Branch: master Commit: 3c54420914c011bdd874a97c4c40ee9dacb59788 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=3c54420… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: Fri Apr 12 00:50:24 2013 +0200 core: safety check for content-lenght size in tcp read - avoid getting negative - upon a report by Kevin Wojtysiak --- tcp_read.c | 14 ++++++++++++++ 1 files changed, 14 insertions(+), 0 deletions(-) diff --git a/tcp_read.c b/tcp_read.c index 53f4a7a..37b577f 100644 --- a/tcp_read.c +++ b/tcp_read.c @@ -797,11 +797,25 @@ int tcp_read_headers(struct tcp_connection *c, int* read_flags) case '\r': case ' ': case '\t': /* FIXME: check if line contains only WS */ + if(r->content_len<0) { + LOG(L_ERR, "bad Content-Length header value %d in" + " state %d\n", r->content_len, r->state); + r->content_len=0; + r->error=TCP_REQ_BAD_LEN; + r->state=H_SKIP; /* skip now */ + } r->state=H_SKIP; r->flags|=F_TCP_REQ_HAS_CLEN; break; case '\n': /* end of line, parse successful */ + if(r->content_len<0) { + LOG(L_ERR, "bad Content-Length header value %d in" + " state %d\n", r->content_len, r->state); + r->content_len=0; + r->error=TCP_REQ_BAD_LEN; + r->state=H_SKIP; /* skip now */ + } r->state=H_LF; r->flags|=F_TCP_REQ_HAS_CLEN; break;

11 years, 9 months

← Newer
1
...
21
22
23
24
25
26
27
...
41
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev April 2013