[sr-dev] git:4.4:3037665c: rtpengine: fixed segfault when using read_sdp_pv

Daniel-Constantin Mierla miconda at gmail.com
Thu Nov 23 14:23:19 CET 2017


Module: kamailio
Branch: 4.4
Commit: 3037665c0794c5e00f074a7e389793a29ba9b960
URL: https://github.com/kamailio/kamailio/commit/3037665c0794c5e00f074a7e389793a29ba9b960

Author: Phil Lavin <phil.lavin at cloudcall.com>
Committer: Daniel-Constantin Mierla <miconda at gmail.com>
Date: 2017-11-23T14:23:15+01:00

rtpengine: fixed segfault when using read_sdp_pv

- Obtain body pointer fresh from the SIP message as when using read_sdp_pv
  the body pointer is overwritten

---

Modified: modules/rtpengine/rtpengine.c

---

Diff:  https://github.com/kamailio/kamailio/commit/3037665c0794c5e00f074a7e389793a29ba9b960.diff
Patch: https://github.com/kamailio/kamailio/commit/3037665c0794c5e00f074a7e389793a29ba9b960.patch

---

diff --git a/modules/rtpengine/rtpengine.c b/modules/rtpengine/rtpengine.c
index 01f1606bf2..b63fb33497 100644
--- a/modules/rtpengine/rtpengine.c
+++ b/modules/rtpengine/rtpengine.c
@@ -3185,6 +3185,7 @@ rtpengine_offer_answer(struct sip_msg *msg, const char *flags, int op, int more)
 	str body, newbody;
 	struct lump *anchor;
 	pv_value_t pv_val;
+	str cur_body = {0, 0};
 
 	dict = rtpp_function_call_ok(&bencbuf, msg, op, flags, &body);
 	if (!dict)
@@ -3214,7 +3215,12 @@ rtpengine_offer_answer(struct sip_msg *msg, const char *flags, int op, int more)
 			pkg_free(newbody.s);
 
 		} else {
-			anchor = del_lump(msg, body.s - msg->buf, body.len, 0);
+			/* get the body from the message as body ptr may have changed */
+			cur_body.len = 0;
+			cur_body.s = get_body(msg);
+			cur_body.len = msg->buf + msg->len - cur_body.s;
+
+			anchor = del_lump(msg, cur_body.s - msg->buf, cur_body.len, 0);
 			if (!anchor) {
 				LM_ERR("del_lump failed\n");
 				goto error_free;




More information about the sr-dev mailing list