[sr-dev] [kamailio/kamailio] Errors when parsing Diversion header with multiple comma-separated diversions (#841)

[Björn Bylander]

Given a Diversion header like the following:

```
Diversion:"Foo
Bar"<sip:+9876543211 at 127.0.0.101;user=phone>;privacy=off;answered-count=2;re
ason=deflection;counter=1;answered,"_
somewhere"<sip:+9876543212 at 127.0.0.101;user=phone>;privacy=off;answered-coun
t=1;reason=deflection;counter=1;answered
```

Kamailio 4.4.3 (and probably earlier versions) emit error messages
complaining about the comma character. According to RFC 6044 multiple
comma-separated diversions in a single Diversion-header is allowed.

Full INVITE as an example:

```
INVITE sip:+1234567890 at 127.0.0.100:5060;user=phone;transport=tcp SIP/2.0 
Via:SIP/2.0/TCP
127.0.0.101;branch=z9hG4bKBroadWorks.-1od4eg8-127.0.0.100V5060-0-82844591-13
54681939-1477634439005- 
From:<sip:+9876543210 at 127.0.0.101;user=phone>;tag=1354681939-1477634439005- 
To:<sip:+1234567890 at 127.0.0.100:5060;user=phone> 
Call-ID:BW0800390052810161562691307 at 127.0.0.101 
CSeq:82844591 INVITE 
Contact:<sip:127.0.0.101:5060;transport=tcp> 
P-Asserted-Identity:<sip:+9876543210 at 127.0.0.101;user=phone> 
Privacy:none 
Diversion:"Foo
Bar"<sip:+9876543211 at 127.0.0.101;user=phone>;privacy=off;answered-count=2;re
ason=deflection;counter=1;answered,"_
somewhere"<sip:+9876543212 at 127.0.0.101;user=phone>;privacy=off;answered-coun
t=1;reason=deflection;counter=1;answered 
Supported:100rel 
Allow:ACK,BYE,CANCEL,INFO,INVITE,OPTIONS,PRACK,REFER,NOTIFY,UPDATE 
X-BroadWorks-DNC:network-address="sip:+9876543210 at 127.0.0.101;user=phone" 
Accept:application/dtmf-relay,application/media_control+xml,application/sdp,
application/x-broadworks-call-center+xml,multipart/mixed 
Max-Forwards:10 
Content-Type:application/sdp 
Content-Disposition:session;handling=required 
Content-Length:267 

v=0 
o=BroadWorks 100442303 1 IN IP4 127.0.0.101 
s=- 
c=IN IP4 127.0.0.102 
t=0 0 
m=audio 29778 RTP/AVP 8 0 18 101 
a=rtpmap:8 PCMA/8000 
a=rtpmap:0 PCMU/8000 
a=rtpmap:18 G729/8000 
a=rtpmap:101 telephone-event/8000 
a=fmtp:101 0-15 
a=sendrecv 
a=maxptime:20
```

Example log messages:

```
Oct 28 08:00:39 kam1 /usr/sbin/kamailio[14935]: ERROR: <core>
[parser/parse_addr_spec.c:488]: parse_to_param(): ERROR parse_to_param :
invalid character ',' in status 21:
<<;privacy=off;answered-count=2;reason=deflection;counter=1;answered>>
Oct 28 08:00:39 kam1 /usr/sbin/kamailio[14935]: ERROR: <core>
[parser/parse_addr_spec.c:254]: parse_to_param(): ERROR: parse_to_param
:unexpected char ["] in status 21:
<<;privacy=off;answered-count=2;reason=deflection;counter=1;answered,>> .
Oct 28 08:00:39 kam1 /usr/sbin/kamailio[14935]: ERROR: <core>
[parser/parse_addr_spec.c:906]: parse_addr_spec(): ERROR: parse_to: invalid
To -  unexpected end of header in state 21
Oct 28 08:00:39 kam1 /usr/sbin/kamailio[14935]: ERROR: <core>
[parser/parse_diversion.c:69]: parse_diversion_header():
ERROR:parse_diversion_header: bad diversion header
Oct 28 08:00:39 kam1 /usr/sbin/kamailio[14935]: ERROR: <core>
[lvalue.c:345]: lval_pvar_assign(): non existing right pvar
Oct 28 08:00:39 kam1 /usr/sbin/kamailio[14935]: ERROR: <core>
[lvalue.c:405]: lval_assign(): assignment failed at pos: (562,21-562,35)

```
The code on line 562 is `$avp(div_user) = $(di{uri.user});`.

kamailio -v:

```version: kamailio 4.4.3 (x86_64/linux)
flags: STATS: Off, USE_TCP, USE_TLS, USE_SCTP, TLS_HOOKS, USE_RAW_SOCKS, DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MEM, SHM_MMAP, PKG_MALLOC, Q_MALLOC, F_MALLOC, TLSF_MALLOC, DBG_SR_MEMORY, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLACKLIST, HAVE_RESOLV_RES
ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535, DEFAULT PKG_SIZE 8MB
poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.
id: unknown
compiled with gcc 4.7.2```

uname -a:

`Linux hostname 3.2.0-4-amd64 #1 SMP Debian 3.2.81-2 x86_64 GNU/Linux`

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/issues/841
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sip-router.org/pipermail/sr-dev/attachments/20161101/9a20d24d/attachment-0001.html>