[OpenSER-Devel] [ openser-Bugs-1834860 ] parse_rr_body doesn't delimit route_set properly

[SourceForge.net]

Bugs item #1834860, was opened at 2007-11-19 16:43
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=743020&aid=1834860&group_id=139143

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: core
Group: ver devel
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: reticent (unspin)
Assigned to: Nobody/Anonymous (nobody)
Summary: parse_rr_body doesn't delimit route_set properly

Initial Comment:
When parsing the route set in reverse order the print_rr_body incorrectly counts the number of elements in the route set leading to a route set value in the dialog (and maybe others?) structure that is missing a delimiter 


Below is an example of the bug:

Example sip message headers:
Record-Route: <sip:65.39.180.33:15061;r2=on;lr;ftag=725f9dde1c6dbbb2o1;nid=UX0.v9G.Wu3>.
Record-Route: <sip:65.39.180.33:15061;transport=tcp;r2=on;lr;ftag=725f9dde1c6dbbb2o1;nid=UX0.v9G.Wu3>.
Record-Route: <sip:207.232.98.31:15061;transport=tcp;r2=on;lr;ftag=725f9dde1c6dbbb2o1;bid=bPP.x3v.E7g>.
Record-Route: <sip:207.232.98.31:15061;r2=on;lr;ftag=725f9dde1c6dbbb2o1;bid=bPP.x3v.E7g>.

After print_rr_body, parsed in reverse order, and skipping 1 entry.
<sip:207.232.98.31:15061;transport=tcp;r2=on;lr;ftag=16ed1c322255e7feo1;bid=bPP.x3v.E7g>,
<sip:65.39.180.33:15061;transport=tcp;r2=on;lr;ftag=16ed1c322255e7feo1;nid=UX0.v9G.Wu3>
<sip:65.39.180.33:15061;r2=on;lr;ftag=16ed1c322255e7feo1;nid=UX0.v9G.Wu3>

Notice between the last two RRs there is no delimiter (",")

Below is a patch that should fix this issue, file: parse_rr.c.patch:



--- trunk/parse_rr.c    2007-11-19 21:43:13.000000000 +0000
+++ fixed/parse_rr.c    2007-11-19 21:52:55.000000000 +0000
@@ -429,7 +429,7 @@ int print_rr_body(struct hdr_field *irou
                {
                        memcpy(cp, route[i].s, route[i].len);
                        cp += route[i].len;
-                       if (--i>0)
+                       if (--i>=0)
                                *(cp++) = ',';
                }
        }


Found by:
Tavis Paquette (tavis at galaxytelecom.net)
Peter Baer (pbaer at galaxytelecom.net)


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=743020&aid=1834860&group_id=139143