kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-12 15:45:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

res_pjsip_refer: Fix crash from a REFER and BYE collision.

Browse Source 
Analyzing a one-off crash on a busy system showed that processing a REFER
request had a NULL session channel pointer.  The only way I can think of
that could cause this is if an outgoing BYE transaction overlapped the
incoming REFER transaction in a collision.  Asterisk sends a BYE while the
phone sends a REFER to complete an attended transfer.

* Made check the session channel pointer before processing an incoming
REFER request in res_pjsip_refer.

* Fixed similar crash potential for res_pjsip supplement incoming request
processing for res_pjsip_sdp_rtp INFO, res_pjsip_caller_id INVITE/UPDATE,
res_pjsip_messaging MESSAGE, and res_pjsip_send_to_voicemail REFER
messages.

* Made res_pjsip_messaging respond to a message body too large with a 413
instead of ignoring it.

ASTERISK-24700 #close
Reported by: Zane Conkle

Review: https://reviewboard.asterisk.org/r/4417/


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/13@431898 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Richard Mudgett
2015-02-17 15:31:46 +00:00
parent 562b7bf6f0
commit 6d3fcfc3c2
5 changed files with 31 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
res/res_pjsip_refer.c
View File

@@ -418,7 +418,7 @@ static void refer_attended_destroy(void *obj)
struct refer_attended *attended = obj;
ao2_cleanup(attended->transferer);
ast_channel_unref(attended->transferer_chan);
ast_channel_cleanup(attended->transferer_chan);
ao2_cleanup(attended->transferer_second);
ao2_cleanup(attended->progress);
}
@@ -674,7 +674,7 @@ static int refer_incoming_attended_request(struct ast_sip_session *session, pjsi
return 200;
} else {
const char *context = (session->channel ? pbx_builtin_getvar_helper(session->channel, "TRANSFER_CONTEXT") : "");
const char *context = pbx_builtin_getvar_helper(session->channel, "TRANSFER_CONTEXT");
struct refer_blind refer = { 0, };
if (ast_strlen_zero(context)) {
@@ -718,10 +718,6 @@ static int refer_incoming_blind_request(struct ast_sip_session *session, pjsip_r
char exten[AST_MAX_EXTENSION];
struct refer_blind refer = { 0, };
if (!session->channel) {
return 404;
}
/* If no explicit transfer context has been provided use their configured context */
context = pbx_builtin_getvar_helper(session->channel, "TRANSFER_CONTEXT");
if (ast_strlen_zero(context)) {
@@ -893,6 +889,14 @@ static int refer_incoming_refer_request(struct ast_sip_session *session, struct
static const pj_str_t str_refer_to = { "Refer-To", 8 };
static const pj_str_t str_replaces = { "Replaces", 8 };
if (!session->channel) {
/* No channel to refer. Likely because the call was just hung up. */
pjsip_dlg_respond(session->inv_session->dlg, rdata, 404, NULL, NULL, NULL);
ast_debug(3, "Received a REFER on a session with no channel from endpoint '%s'.\n",
ast_sorcery_object_get_id(session->endpoint));
return 0;
}
if (!session->endpoint->allowtransfer) {
pjsip_dlg_respond(session->inv_session->dlg, rdata, 603, NULL, NULL, NULL);
ast_log(LOG_WARNING, "Endpoint %s transfer attempt blocked due to configuration\n",