if (((*pos) == '>')||(*pos == ';'))
{
/* invalid chars inside username part */
return -5;
}
The ABNF in RFC3261 makes it clear that a semicolon is ok in the user-info field:
userinfo = ( user / telephone-subscriber ) [ ":" password ] "@"
user = 1*( unreserved / escaped / user-unreserved )
user-unreserved = "&" / "=" / "+" / "$" / "," / ";" / "?" / "/"
The code might be to check for the end of a URI (both those characters terminate a URI under certain circumstances), perhaps for fault tolerance and/or security but I don't think it's been done in a way that makes sense, for the following reasons:
1. An angle bracket is not legal in or surrounding a request URI, so it should be picked up by the parser and/or sanity check.
2. A semicolon is totally legal in the userinfo part, as per ABNF and also as explained in RFC3261:
...
The last sample URI above has a user field value of
"alice;day=tuesday". The escaping rules defined above allow a
semicolon to appear unescaped in this field. For the purposes of
this protocol, the field is opaque. The structure of that value is
only useful to the SIP element responsible for the resource.
Richard