Changeset 3190

Timestamp:

Jun 2, 2010 3:03:43 AM (14 years ago)

Author:

bennylp

Message:

Fixed #1092 (Crash when receiving various messages with "Contact: *" header format)

Location:

pjproject/trunk/pjsip/src

Files:

• pjsip-ua/sip_inv.c (modified) (2 diffs)
• pjsip/sip_dialog.c (modified) (6 diffs)
• pjsua-lib/pjsua_acc.c (modified) (1 diff)
• pjsua-lib/pjsua_im.c (modified) (1 diff)
• pjsua-lib/pjsua_pres.c (modified) (1 diff)

pjproject/trunk/pjsip/src/pjsip-ua/sip_inv.c

@@ -751 +751 @@
     pjsip_supported_hdr *sup_hdr;
     pjsip_require_hdr *req_hdr;
+    pjsip_contact_hdr *c_hdr;
     int code = 200;
     unsigned rem_option = 0;
@@ -784 +785 @@
     /* Init response header list */
     pj_list_init(&res_hdr_list);
+
+    /* Check the Contact header */
+    c_hdr = (pjsip_contact_hdr*)
+            pjsip_msg_find_hdr(msg, PJSIP_H_CONTACT, NULL);
+    if (!c_hdr || !c_hdr->uri) {
+        /* Missing Contact header or Contact contains "*" */
+        pjsip_warning_hdr *w;
+        pj_str_t warn_text;
+
+        warn_text = pj_str("Bad/missing Contact header");
+        w = pjsip_warning_hdr_create(rdata->tp_info.pool, 399,
+                                     pjsip_endpt_name(endpt),
+                                     &warn_text);
+        if (w) {
+            pj_list_push_back(&res_hdr_list, w);
+        }
+
+        code = PJSIP_SC_BAD_REQUEST;
+        status = PJSIP_ERRNO_FROM_SIP_STATUS(code);
+        goto on_return;
+    }
 
     /* Check the request body, see if it's something that we support,

pjproject/trunk/pjsip/src/pjsip/sip_dialog.c

@@ -433 +433 @@
                                          pos);
         if (contact_hdr) {
-            if (!PJSIP_URI_SCHEME_IS_SIP(contact_hdr->uri) && 
-                !PJSIP_URI_SCHEME_IS_SIPS(contact_hdr->uri))
+            if (!contact_hdr->uri ||
+                (!PJSIP_URI_SCHEME_IS_SIP(contact_hdr->uri) &&
+                 !PJSIP_URI_SCHEME_IS_SIPS(contact_hdr->uri)))
             {
                 pos = (pjsip_hdr*)contact_hdr->next;
@@ -612 +613 @@
     contact = (const pjsip_contact_hdr*)
               pjsip_msg_find_hdr(msg, PJSIP_H_CONTACT, NULL);
-    if (contact == NULL)
+    if (contact == NULL || contact->uri == NULL)
         return PJSIP_EMISSINGHDR;
 
@@ -1502 +1503 @@
 
 
-/* This function is called by user agent upon receiving incoming response
+/* This function is called by user agent upon receiving incoming request
  * message.
  */
@@ -1589 +1590 @@
                   pjsip_msg_find_hdr(rdata->msg_info.msg, PJSIP_H_CONTACT, 
                                      NULL);
-        if (contact && (dlg->remote.contact==NULL ||
-                        pjsip_uri_cmp(PJSIP_URI_IN_REQ_URI, 
-                                      dlg->remote.contact->uri, 
-                                      contact->uri)))
+        if (contact && contact->uri &&
+            (dlg->remote.contact==NULL ||
+             pjsip_uri_cmp(PJSIP_URI_IN_REQ_URI,
+                           dlg->remote.contact->uri,
+                           contact->uri)))
         {
             dlg->remote.contact = (pjsip_contact_hdr*) 
@@ -1794 +1796 @@
                   pjsip_msg_find_hdr(rdata->msg_info.msg, PJSIP_H_CONTACT, 
                                      NULL);
-        if (contact && (dlg->remote.contact==NULL ||
-                        pjsip_uri_cmp(PJSIP_URI_IN_REQ_URI, 
-                                      dlg->remote.contact->uri, 
-                                      contact->uri)))
+        if (contact && contact->uri &&
+            (dlg->remote.contact==NULL ||
+             pjsip_uri_cmp(PJSIP_URI_IN_REQ_URI,
+                           dlg->remote.contact->uri,
+                           contact->uri)))
         {
             dlg->remote.contact = (pjsip_contact_hdr*) 
@@ -1844 +1847 @@
                                                           PJSIP_H_CONTACT, 
                                                           NULL);
-        if (contact && (dlg->remote.contact==NULL ||
-                        pjsip_uri_cmp(PJSIP_URI_IN_REQ_URI, 
-                                      dlg->remote.contact->uri, 
-                                      contact->uri)))
+        if (contact && contact->uri &&
+            (dlg->remote.contact==NULL ||
+             pjsip_uri_cmp(PJSIP_URI_IN_REQ_URI,
+                           dlg->remote.contact->uri,
+                           contact->uri)))
         {
             dlg->remote.contact = (pjsip_contact_hdr*) 

pjproject/trunk/pjsip/src/pjsua-lib/pjsua_acc.c

@@ -2238 +2238 @@
                                            pos);
             if (h_contact) {
-                uri = (pjsip_uri*) pjsip_uri_get_uri(h_contact->uri);
-                if (!PJSIP_URI_SCHEME_IS_SIP(uri) && 
-                    !PJSIP_URI_SCHEME_IS_SIPS(uri))
+                if (h_contact->uri)
+                    uri = (pjsip_uri*) pjsip_uri_get_uri(h_contact->uri);
+                else
+                    uri = NULL;
+                if (!uri || (!PJSIP_URI_SCHEME_IS_SIP(uri) &&
+                             !PJSIP_URI_SCHEME_IS_SIPS(uri)))
                 {
                     pos = (pjsip_hdr*)h_contact->next;

pjproject/trunk/pjsip/src/pjsua-lib/pjsua_im.c

@@ -170 +170 @@
                   pjsip_msg_find_hdr(rdata->msg_info.msg, PJSIP_H_CONTACT,
                                      NULL);
-    if (contact_hdr) {
+    if (contact_hdr && contact_hdr->uri) {
         contact.ptr = (char*) pj_pool_alloc(rdata->tp_info.pool, 
                                             PJSIP_MAX_URL_SIZE);

pjproject/trunk/pjsip/src/pjsua-lib/pjsua_pres.c

@@ -1611 +1611 @@
                   pjsip_msg_find_hdr(event->body.rx_msg.rdata->msg_info.msg,
                                      PJSIP_H_CONTACT, NULL);
-    if (!contact_hdr) {
+    if (!contact_hdr || !contact_hdr->uri) {
         return;
     }