[sr-dev] Segfault in tm module

[Richard Fuchs]

Hi,

cancel_branch (t_cancel.c) contains a segfault in lines 284-288 when
cfg_get(tm, tm_cfg, reparse_invite) is true but t->uas.request is NULL.
My suggested fix is below but I'm not 100% sure if this is really correct.

cheers
-------------- next part --------------
diff --git a/modules/tm/t_cancel.c b/modules/tm/t_cancel.c
index ccd2212..1b39648 100644
--- a/modules/tm/t_cancel.c
+++ b/modules/tm/t_cancel.c
@@ -285,7 +285,7 @@ int cancel_branch( struct cell *t, int branch,
                        (t->uas.request && t->uas.request->msg_flags&(FL_USE_UAC_FROM|FL_USE_UAC_TO))) {
                /* build the CANCEL from the INVITE which was sent out */
                cancel = build_local_reparse(t, branch, &len, CANCEL, CANCEL_LEN,
-                                                                        (t->uas.request->msg_flags&FL_USE_UAC_TO)?0:&t->to
+                                                                        (t->uas.request && t->uas.request->msg_flags&FL_USE_UAC_TO)?0:&t->to
        #ifdef CANCEL_REASON_SUPPORT
                                                                         , reason
        #endif /* CANCEL_REASON_SUPPORT */
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <http://lists.sip-router.org/pipermail/sr-dev/attachments/20131024/39a78a84/attachment.pgp>