From 5e34c49a669cd0b835d877c7d8cc4a3e0ab130a2 Mon Sep 17 00:00:00 2001 From: Matthew Jordan Date: Tue, 27 Aug 2013 16:03:27 +0000 Subject: [PATCH] AST-2013-004: Fix crash when handling ACK on dialog that has no channel A remote exploitable crash vulnerability exists in the SIP channel driver if an ACK with SDP is received after the channel has been terminated. The handling code incorrectly assumed that the channel would always be present. This patch adds a check such that the SDP will only be parsed and applied if Asterisk has a channel present that is associated with the dialog. Note that the patch being applied was modified only slightly from the patch provided by Walter Doekes of OSSO B.V. (closes issue ASTERISK-21064) Reported by: Colin Cuthbertson Tested by: wdoekes, Colin Cutherbertson patches: issueA21064_fix.patch uploaded by wdoekes (License 5674) ........ Merged revisions 397710 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 397711 from http://svn.asterisk.org/svn/asterisk/branches/10 ........ Merged revisions 397712 from http://svn.asterisk.org/svn/asterisk/branches/11 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/12@397713 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- channels/chan_sip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/channels/chan_sip.c b/channels/chan_sip.c index e4596a892f..57a18a13dd 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -28166,7 +28166,7 @@ static int handle_incoming(struct sip_pvt *p, struct sip_request *req, struct as p->invitestate = INV_TERMINATED; p->pendinginvite = 0; acked = __sip_ack(p, seqno, 1 /* response */, 0); - if (find_sdp(req)) { + if (p->owner && find_sdp(req)) { if (process_sdp(p, req, SDP_T38_NONE)) { return -1; }