chan_mgcp: Properly handle malformed media lines

This corrects a situation in which a media line was not parsed properly
and resulted in a crash.

(closes issue ASTERISK-21190)
Reported by: adomjan
Patches:
    chan_mgcp.c-sscnaf_fix uploaded by adomjan (License 5448)
........

Merged revisions 401537 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 401538 from http://svn.asterisk.org/svn/asterisk/branches/11
........

Merged revisions 401539 from http://svn.asterisk.org/svn/asterisk/branches/12


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@401540 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Kinsey Moore
2013-10-23 15:23:58 +00:00
parent f4e028a765
commit dfd3f4ef46

View File

@@ -1971,7 +1971,7 @@ static int process_sdp(struct mgcp_subchannel *sub, struct mgcp_request *req)
char *c; char *c;
char *a; char *a;
char host[258]; char host[258];
int len; int len = 0;
int portno; int portno;
struct ast_format_cap *peercap; struct ast_format_cap *peercap;
int peerNonCodecCapability; int peerNonCodecCapability;
@@ -2001,8 +2001,8 @@ static int process_sdp(struct mgcp_subchannel *sub, struct mgcp_request *req)
ast_log(LOG_WARNING, "Unable to lookup host in c= line, '%s'\n", c); ast_log(LOG_WARNING, "Unable to lookup host in c= line, '%s'\n", c);
return -1; return -1;
} }
if (sscanf(m, "audio %30d RTP/AVP %n", &portno, &len) != 1) { if (sscanf(m, "audio %30d RTP/AVP %n", &portno, &len) != 1 || !len) {
ast_log(LOG_WARNING, "Unable to determine port number for RTP in '%s'\n", m); ast_log(LOG_WARNING, "Malformed media stream descriptor: %s\n", m);
return -1; return -1;
} }
sin.sin_family = AF_INET; sin.sin_family = AF_INET;