Index: /pjproject/trunk/pjmedia/src/pjmedia/sdp.c
===================================================================
--- /pjproject/trunk/pjmedia/src/pjmedia/sdp.c	(revision 2926)
+++ /pjproject/trunk/pjmedia/src/pjmedia/sdp.c	(revision 2927)
@@ -1020,5 +1020,7 @@
     pj_scan_get(scanner, &cs_token, &attr->name);
 
-    if (*scanner->curptr != '\r' && *scanner->curptr != '\n') {
+    if (*scanner->curptr && *scanner->curptr != '\r' && 
+	*scanner->curptr != '\n') 
+    {
 	/* skip ':' if present. */
 	if (*scanner->curptr == ':')
Index: /pjproject/trunk/tests/pjsua/scripts-sipp/uac-reinvite-port-0-bad-sdp.xml
===================================================================
--- /pjproject/trunk/tests/pjsua/scripts-sipp/uac-reinvite-port-0-bad-sdp.xml	(revision 2927)
+++ /pjproject/trunk/tests/pjsua/scripts-sipp/uac-reinvite-port-0-bad-sdp.xml	(revision 2927)
@@ -0,0 +1,207 @@
+<?xml version="1.0" encoding="ISO-8859-1" ?>
+<!DOCTYPE scenario SYSTEM "sipp.dtd">
+
+<!-- This program is free software; you can redistribute it and/or      -->
+<!-- modify it under the terms of the GNU General Public License as     -->
+<!-- published by the Free Software Foundation; either version 2 of the -->
+<!-- License, or (at your option) any later version.                    -->
+<!--                                                                    -->
+<!-- This program is distributed in the hope that it will be useful,    -->
+<!-- but WITHOUT ANY WARRANTY; without even the implied warranty of     -->
+<!-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the      -->
+<!-- GNU General Public License for more details.                       -->
+<!--                                                                    -->
+<!-- You should have received a copy of the GNU General Public License  -->
+<!-- along with this program; if not, write to the                      -->
+<!-- Free Software Foundation, Inc.,                                    -->
+<!-- 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA             -->
+<!--                                                                    -->
+<!--                                                                    -->
+
+<!-- Note:
+     For this test to work, PJSUA-LIB needs to add video line, with
+     this patch:
+
+     pjsua_media.c:1253, after call to pjmedia_endpt_create_sdp():
+
+    if (1) {
+	pjmedia_sdp_media *m = PJ_POOL_ZALLOC_T(pool, pjmedia_sdp_media);
+	m->desc.media = pj_str("video");
+	m->desc.port = 3000;
+	m->desc.transport = pj_str("RTP/AVP");
+	m->desc.fmt_count = 1;
+	m->desc.fmt[0] = pj_str("0");
+	sdp->media[sdp->media_count++] = m;
+    }
+
+-->
+     
+
+<scenario name="UAC with bad ACK">
+  <!-- UAC with bad ACK causes assertion with pjsip 1.4			-->
+  <send retrans="500">
+    <![CDATA[
+
+      INVITE sip:[service]@[remote_ip]:[remote_port] SIP/2.0
+      Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+      From: sipp <sip:sipp@[local_ip]:[local_port]>;tag=[call_number]
+      To: sut <sip:[service]@[remote_ip]:[remote_port]>
+      Call-ID: [call_id]
+      CSeq: 1 INVITE
+      Contact: sip:sipp@[local_ip]:[local_port]
+      Max-Forwards: 70
+      Subject: Performance Test
+      Content-Type: application/sdp
+      Content-Length: [len]
+
+      v=0
+      o=Tester 234 123 IN IP4 89.208.145.194
+      s=Tester
+      c=IN IP4 89.208.145.194
+      t=0 0
+      m=audio 17424 RTP/AVP 111 0 18 101
+      a=rtpmap:111 SPEEX/16000
+      a=rtpmap:0 PCMU/8000
+      a=rtpmap:18 G729/8000
+      a=rtpmap:101 telephone-event/8000
+      a=sendrecv
+      a=rtcp:17425
+      m=video 11128 RTP/AVP 34 103 104
+      a=rtpmap:34 H263/90000
+      a=rtpmap:103 H263-1998/90000
+      a=rtpmap:104 H264/90000
+      a=sendrecv
+      a=rtcp:11129
+
+    ]]>
+  </send>
+
+  <recv response="100"
+        optional="true">
+  </recv>
+
+  <recv response="180" optional="true">
+  </recv>
+
+  <!-- By adding rrs="true" (Record Route Sets), the route sets         -->
+  <!-- are saved and used for following messages sent. Useful to test   -->
+  <!-- against stateful SIP proxies/B2BUAs.                             -->
+  <recv response="200" rtd="true">
+  </recv>
+
+  <!-- Packet lost can be simulated in any send/recv message by         -->
+  <!-- by adding the 'lost = "10"'. Value can be [1-100] percent.       -->
+  <send>
+    <![CDATA[
+
+      ACK sip:[service]@[remote_ip]:[remote_port] SIP/2.0
+      Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+      From: sipp <sip:sipp@[local_ip]:[local_port]>;tag=[call_number]
+      To: sut <sip:[service]@[remote_ip]:[remote_port]>[peer_tag_param]
+      Call-ID: [call_id]
+      CSeq: 1 ACK
+      Contact: sip:sipp@[local_ip]:[local_port]
+      Max-Forwards: 70
+      Subject: Performance Test
+      Content-Length: 0
+
+    ]]>
+  </send>
+
+  <!-- This delay can be customized by the -d command-line option       -->
+  <!-- or by adding a 'milliseconds = "value"' option here.             -->
+  <pause milliseconds="2000"/>
+
+  <send retrans="500">
+    <![CDATA[
+
+      INVITE sip:[service]@[remote_ip]:[remote_port] SIP/2.0
+      Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+      From: sipp <sip:sipp@[local_ip]:[local_port]>;tag=[call_number]
+      To: sut <sip:[service]@[remote_ip]:[remote_port]>[peer_tag_param]
+      Call-ID: [call_id]
+      CSeq: 2 INVITE
+      Contact: sip:sipp@[local_ip]:[local_port]
+      Max-Forwards: 70
+      Subject: Performance Test
+      Content-Type: application/sdp
+      Content-Length: [len]
+
+      v=0
+      o=Tester 234 124 IN IP4 89.208.145.194
+      s=Tester
+      c=IN IP4 89.208.145.194
+      t=0 0
+      m=audio 17424 RTP/AVP 111 0 18 101
+      a=rtpmap:111 SPEEX/16000
+      a=rtpmap:0 PCMU/8000
+      a=rtpmap:18 G729/8000
+      a=rtpmap:101 telephone-event/8000
+      a=sendrecv
+      a=rtcp:17425
+      m=video 0 RTP/AVP 34 103 104
+      a=sendrecv
+
+
+    ]]>
+  </send>
+
+  <!-- By adding rrs="true" (Record Route Sets), the route sets         -->
+  <!-- are saved and used for following messages sent. Useful to test   -->
+  <!-- against stateful SIP proxies/B2BUAs.                             -->
+  <recv response="200" rtd="true">
+  </recv>
+
+  <!-- Packet lost can be simulated in any send/recv message by         -->
+  <!-- by adding the 'lost = "10"'. Value can be [1-100] percent.       -->
+  <send>
+    <![CDATA[
+
+      ACK sip:[service]@[remote_ip]:[remote_port] SIP/2.0
+      Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+      From: sipp <sip:sipp@[local_ip]:[local_port]>;tag=[call_number]
+      To: sut <sip:[service]@[remote_ip]:[remote_port]>[peer_tag_param]
+      Call-ID: [call_id]
+      CSeq: 2 ACK
+      Contact: sip:sipp@[local_ip]:[local_port]
+      Max-Forwards: 70
+      Subject: Performance Test
+      Content-Length: 0
+
+    ]]>
+  </send>
+
+
+  <pause milliseconds="2000"/>
+
+
+  <!-- The 'crlf' option inserts a blank line in the statistics report. -->
+  <send retrans="500">
+    <![CDATA[
+
+      BYE sip:[service]@[remote_ip]:[remote_port] SIP/2.0
+      Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
+      From: sipp <sip:sipp@[local_ip]:[local_port]>;tag=[call_number]
+      To: sut <sip:[service]@[remote_ip]:[remote_port]>[peer_tag_param]
+      Call-ID: [call_id]
+      CSeq: 3 BYE
+      Contact: sip:sipp@[local_ip]:[local_port]
+      Max-Forwards: 70
+      Subject: Performance Test
+      Content-Length: 0
+
+    ]]>
+  </send>
+
+  <recv response="200" crlf="true">
+  </recv>
+
+
+  <!-- definition of the response time repartition table (unit is ms)   -->
+  <ResponseTimeRepartition value="10, 20, 30, 40, 50, 100, 150, 200"/>
+
+  <!-- definition of the call length repartition table (unit is ms)     -->
+  <CallLengthRepartition value="10, 50, 100, 500, 1000, 5000, 10000"/>
+
+</scenario>
+
