[sr-dev] git:master:36cb7534: rtpengine: fixed segfault when using read_sdp_pv
Phil Lavin
phil.lavin at cloudcall.com
Thu Nov 23 11:59:26 CET 2017
Module: kamailio
Branch: master
Commit: 36cb753441a78bd13ded119cd468f32623f09fbf
URL: https://github.com/kamailio/kamailio/commit/36cb753441a78bd13ded119cd468f32623f09fbf
Author: Phil Lavin <phil.lavin at cloudcall.com>
Committer: Phil Lavin <phil.lavin at cloudcall.com>
Date: 2017-11-23T10:22:42Z
rtpengine: fixed segfault when using read_sdp_pv
- Obtain body pointer fresh from the SIP message as when using read_sdp_pv
the body pointer is overwritten
---
Modified: src/modules/rtpengine/rtpengine.c
---
Diff: https://github.com/kamailio/kamailio/commit/36cb753441a78bd13ded119cd468f32623f09fbf.diff
Patch: https://github.com/kamailio/kamailio/commit/36cb753441a78bd13ded119cd468f32623f09fbf.patch
---
diff --git a/src/modules/rtpengine/rtpengine.c b/src/modules/rtpengine/rtpengine.c
index e3468d04a8..9704693eee 100644
--- a/src/modules/rtpengine/rtpengine.c
+++ b/src/modules/rtpengine/rtpengine.c
@@ -3328,6 +3328,7 @@ rtpengine_offer_answer(struct sip_msg *msg, const char *flags, int op, int more)
str body, newbody;
struct lump *anchor;
pv_value_t pv_val;
+ str cur_body = {0, 0};
dict = rtpp_function_call_ok(&bencbuf, msg, op, flags, &body);
if (!dict)
@@ -3357,7 +3358,12 @@ rtpengine_offer_answer(struct sip_msg *msg, const char *flags, int op, int more)
pkg_free(newbody.s);
} else {
- anchor = del_lump(msg, body.s - msg->buf, body.len, 0);
+ /* get the body from the message as body ptr may have changed */
+ cur_body.len = 0;
+ cur_body.s = get_body(msg);
+ cur_body.len = msg->buf + msg->len - cur_body.s;
+
+ anchor = del_lump(msg, cur_body.s - msg->buf, cur_body.len, 0);
if (!anchor) {
LM_ERR("del_lump failed\n");
goto error_free;
More information about the sr-dev
mailing list