Changeset 2915

Timestamp:

Sep 22, 2009 5:56:44 PM (15 years ago)

Author:

bennylp

Message:

Fixed ticket #959: Assertion upon receiving malformed SIP messages (thanks Andrey Kovalenko for the report)

• transaction checks for the method before processing incoming ACK request
• transport layer checks the validity of status code in the response
• added SIPP scenario to reproduce the bad ACK request

Location:

pjproject/trunk

Files:

• pjsip/src/pjsip/sip_transaction.c (modified) (1 diff)
• pjsip/src/pjsip/sip_transport.c (modified) (1 diff)
• tests/pjsua/scripts-sipp/uac-bad-ack.xml (added)

pjproject/trunk/pjsip/src/pjsip/sip_transaction.c

@@ -2841 +2841 @@
             /* Process incoming ACK request. */
 
+            /* Verify that this is an INVITE transaction */
+            if (tsx->method.id != PJSIP_INVITE_METHOD) {
+                PJ_LOG(2, (tsx->obj_name, 
+                           "Received illegal ACK for %.*s transaction",
+                           (int)tsx->method.name.slen,
+                           tsx->method.name.ptr));
+                return PJSIP_EINVALIDMETHOD;
+            }
+
             /* Cease retransmission. */
             if (tsx->retransmit_timer.id != 0) {

pjproject/trunk/pjsip/src/pjsip/sip_transport.c

@@ -1440 +1440 @@
                 rdata->msg_info.via->rport_param = rdata->pkt_info.src_port;
             }
+        } else {
+            /* Drop malformed responses */
+            if (rdata->msg_info.msg->line.status.code < 100 ||
+                rdata->msg_info.msg->line.status.code >= 700)
+            {
+                mgr->on_rx_msg(mgr->endpt, PJSIP_EINVALIDSTATUS, rdata);
+                goto finish_process_fragment;
+            }
         }