[sr-dev] git:sr_3.0: tm: fake_req dst_uri and ruri copy fix

[Andrei Pelinescu-Onciul]

Module: sip-router
Branch: sr_3.0
Commit: 583d213cb617e767f5895de18168d7516e51e5e6
URL:    http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=583d213cb617e767f5895de18168d7516e51e5e6

Author: Andrei Pelinescu-Onciul <andrei at iptel.org>
Committer: Andrei Pelinescu-Onciul <andrei at iptel.org>
Date:   Wed Feb 17 20:40:46 2010 +0100

tm: fake_req dst_uri and ruri copy fix

If the uris have 0 len but no 0 value (possible at least for a
manually set dst_uri), set the corresponding fake_req uri to 0,
thus avoiding a potentially disastrous free in free_faked_req().

Should close FS#37.

---

 modules/tm/t_reply.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/modules/tm/t_reply.c b/modules/tm/t_reply.c
index 02b03e5..ff89dd4 100644
--- a/modules/tm/t_reply.c
+++ b/modules/tm/t_reply.c
@@ -772,6 +772,9 @@ int fake_req(struct sip_msg *faked_req,
 		memcpy( faked_req->dst_uri.s, shmem_msg->dst_uri.s,
 			faked_req->dst_uri.len);
 		faked_req->dst_uri.s[faked_req->dst_uri.len]=0;
+	}else{
+		/* in case len==0, but shmem_msg->dst_uri.s!=0 (extra safety) */
+		faked_req->dst_uri.s = 0;
 	}
 	/* new_uri can change -- make a private copy */
 	if (shmem_msg->new_uri.s!=0 && shmem_msg->new_uri.len!=0) {
@@ -784,6 +787,9 @@ int fake_req(struct sip_msg *faked_req,
 		memcpy( faked_req->new_uri.s, shmem_msg->new_uri.s,
 			faked_req->new_uri.len);
 		faked_req->new_uri.s[faked_req->new_uri.len]=0;
+	}else{
+		/* in case len==0, but shmem_msg->new_uri.s!=0  (extra safety)*/
+		faked_req->new_uri.s = 0;
 	}
 	if(uac) setbflagsval(0, uac->branch_flags);
 	else setbflagsval(0, 0);