sysmocom
/
asterisk
11
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

res_pjsip_header_funcs: wrong pool used tdata headers 

When adding headers to an outgoing request the headers were cloned using
the dialog's pool when they should have been cloned using tdata's pool.
Under certain circumstances it was possible for the dialog object, and
its pool to be freed while tdata is still active and available. Thus the
cloned header "disappeared", and when tdata tried to later access it a
crash would occur.

This patch makes it so all added headers are cloned appropriately using
tdata's pool.

ASTERISK-29411 #close
ASTERISK-29535 #close

Change-Id: I9852025b5ee93ce1c038209150ee9dba1e0767c5
This commit is contained in:
Kevin Harwell 2022-03-23 17:45:45 -05:00 committed by Kevin Harwell
parent 30cefc97a6
commit 0e31df6c93
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
res/res_pjsip_header_funcs.c
View File

@ -747,7 +747,6 @@ static struct ast_custom_function pjsip_headers_function = {
*/
static void outgoing_request(struct ast_sip_session *session, pjsip_tx_data * tdata)
{
pj_pool_t *pool = session->inv_session->dlg->pool;
struct hdr_list *list;
struct hdr_list_entry *le;
RAII_VAR(struct ast_datastore *, datastore,
@ -760,7 +759,7 @@ static void outgoing_request(struct ast_sip_session *session, pjsip_tx_data * td
list = datastore->data;
AST_LIST_TRAVERSE(list, le, nextptr) {
pjsip_msg_add_hdr(tdata->msg, (pjsip_hdr *) pjsip_hdr_clone(pool, le->hdr));
pjsip_msg_add_hdr(tdata->msg, (pjsip_hdr *) pjsip_hdr_clone(tdata->pool, le->hdr));
}
ast_sip_session_remove_datastore(session, datastore->uid);
}