[sr-dev] git:luismartingil/msrp_crash: msrp: improved parser

[Luis Martin Gil]

Module: sip-router
Branch: luismartingil/msrp_crash
Commit: 31469a0541874b1b0a5dda89aec0eed4ad94d97e
URL:    http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=31469a0541874b1b0a5dda89aec0eed4ad94d97e

Author: Luis Martin Gil <martingil.luis at gmail.com>
Committer: Luis Martin Gil <martingil.luis at gmail.com>
Date:   Thu Apr 17 12:49:52 2014 +0000

	msrp: improved parser

        - Added more logic to the parser: Not allowing multiple
	To-Paths or From-Paths

---

 modules/msrp/msrp_parser.c |   26 ++++++++++++++++++--------
 1 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/modules/msrp/msrp_parser.c b/modules/msrp/msrp_parser.c
index b23c5a1..fc81798 100644
--- a/modules/msrp/msrp_parser.c
+++ b/modules/msrp/msrp_parser.c
@@ -293,24 +293,34 @@ int msrp_parse_headers(msrp_frame_t *mf)
 			last = hdr;
 		}
 		msrp_hdr_set_type(hdr);
-	
+
+		/* Checking for well-formed MSRP rfc4975 messages */
 		if (hdr->htype == MSRP_HDR_TO_PATH) {
-			tpath = 1;
-			if (fpath || any) {
+			if (tpath) {
+				LM_ERR("broken msrp frame message, Multiple To-Path not allowed.\n");
+				return -1;				
+			} else if (fpath || any) {
 				LM_ERR("broken msrp frame message, To-Path must be the first header.\n");
-				return -1;		    
+				return -1;
+			} else {
+				tpath = 1;
 			}
 		} else if (hdr->htype == MSRP_HDR_FROM_PATH) {
-			fpath = 1;
-			if (!tpath || any) {
-				LM_ERR("broken msrp frame message, From-Path must be the second header.\n");
+			if (fpath) {
+				LM_ERR("broken msrp frame message, Multiple From-Path not allowed.\n");
 				return -1;
+			} else if (!tpath || any) {
+				LM_ERR("broken msrp frame message, From-Path must be after To-Path.\n");
+				return -1;
+			} else {
+				fpath = 1;
 			}
 		} else {
-			any = 1;
 			if (!tpath || !fpath) {
 				LM_ERR("broken msrp frame message, To-Path and From-Path must be defined before any header.\n");
 				return -1;
+			} else {
+				any = 1;
 			}
 		}