Changeset 2936

Timestamp:

Oct 10, 2009 1:36:43 PM (15 years ago)

Author:

bennylp

Message:

Ticket #965: Receiving (malformed) re-INVITE with the same Via branch parameter value as previous INVITE would raise assertion (thanks Daniel Nanassy for the report)

• also fix possible crashes when UAS transaction initialization fails for some reason

Location:

pjproject/trunk/pjsip/src/pjsip

Files:

• sip_dialog.c (modified) (1 diff)
• sip_transaction.c (modified) (4 diffs)

pjproject/trunk/pjsip/src/pjsip/sip_dialog.c

@@ -1533 +1533 @@
     {
         status = pjsip_tsx_create_uas(dlg->ua, rdata, &tsx);
-        PJ_ASSERT_ON_FAIL(status==PJ_SUCCESS,{goto on_return;});
+        if (status != PJ_SUCCESS) {
+            /* Once case for this is when re-INVITE contains same
+             * Via branch value as previous INVITE (ticket #965).
+             */
+            char errmsg[PJ_ERR_MSG_SIZE];
+            pj_str_t reason;
+
+            reason = pj_strerror(status, errmsg, sizeof(errmsg));
+            pjsip_endpt_respond_stateless(dlg->endpt, rdata, 500, &reason,
+                                          NULL, NULL);
+            goto on_return;
+        }
 
         /* Put this dialog in the transaction data. */

pjproject/trunk/pjsip/src/pjsip/sip_transaction.c

@@ -546 +546 @@
      * twice!
      */
-    pj_assert(pj_hash_get( mod_tsx_layer.htable, 
-                           tsx->transaction_key.ptr,
-                           tsx->transaction_key.slen, 
-                           NULL) == NULL);
+    if(pj_hash_get(mod_tsx_layer.htable, 
+                   tsx->transaction_key.ptr,
+                   tsx->transaction_key.slen, 
+                   NULL))
+    {
+        pj_mutex_unlock(mod_tsx_layer.mutex);
+        PJ_LOG(2,(THIS_FILE, "Unable to register transaction (key exists)"));
+        return PJ_EEXISTS;
+    }
 
     TSX_TRACE_((THIS_FILE, 
@@ -1345 +1350 @@
                                   PJSIP_ROLE_UAS, &tsx->method, rdata);
     if (status != PJ_SUCCESS) {
+        unlock_tsx(tsx, &lck);
         tsx_destroy(tsx);
         return status;
@@ -1372 +1378 @@
     status = pjsip_get_response_addr( tsx->pool, rdata, &tsx->res_addr );
     if (status != PJ_SUCCESS) {
+        unlock_tsx(tsx, &lck);
         tsx_destroy(tsx);
         return status;
@@ -1394 +1401 @@
     status = mod_tsx_layer_register_tsx(tsx);
     if (status != PJ_SUCCESS) {
+        unlock_tsx(tsx, &lck);
         tsx_destroy(tsx);
         return status;