[asterisk-bugs] [JIRA] (ASTERISK-22187) Crash in sip_msg_send in chan_sip.c when from parameter is malformed

[Matt Jordan (JIRA)]

Matt Jordan created ASTERISK-22187:
--------------------------------------

             Summary: Crash in sip_msg_send in chan_sip.c when from parameter is malformed
                 Key: ASTERISK-22187
                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-22187
             Project: Asterisk
          Issue Type: Bug
      Security Level: None
          Components: Channels/chan_sip/Messaging
    Affects Versions: 11.4.0, 11.5.0
         Environment: AsteriskNow distro
Linux 2.6.32-358.2.1.el6.i686 #1 SMP Tue Mar 12 21:42:46 UTC 2013 i686 i686 i386 GNU/Linux
            Reporter: Zhang Lei
            Severity: Critical


Here is the GDB stack trace:
{noformat}
(gdb) bt
#0  0x0079d443 in strchr () from /lib/libc.so.6
#1  0x015a5ee4 in sip_msg_send (msg=0xb7403d34, to=0xb4d82bc0 "sip:9518", from=<value optimized out>)
    at chan_sip.c:26744
#2  0x0816325f in msg_send_exec ()
#3  0x08174d7d in pbx_exec ()
#4  0x08180738 in pbx_extension_helper ()
#5  0x081886b0 in __ast_pbx_run ()
#6  0x0818a7c0 in ast_pbx_outgoing_exten ()
#7  0x00f29504 in attempt_thread (data=0xb5890328) at pbx_spool.c:382
#8  0x081d1f67 in dummy_start ()
#9  0x008caa49 in start_thread () from /lib/libpthread.so.0
#10 0x00806aee in clone () from /lib/libc.so.6
{noformat}

{noformat}
(gdb) frame 1
#1  0x015a5ee4 in sip_msg_send (msg=0xb7403d34, to=0xb4d82bc0 "sip:9518", from=<value optimized out>)
    at chan_sip.c:26744
26744	chan_sip.c: 没有那个文件或目录.
	in chan_sip.c
(gdb) p location
$1 = 0x0
{noformat}


In chan_sip.c:26774
{noformat}
26742                         ast_callerid_parse(sender, &name, &location);
26743                         ast_string_field_set(pvt, fromname, name);
26744                         if (strchr(location, ':')) { /* Must be a URI */
{noformat}

If a malform from parameter is passed(such as "<sip:8888 at 10.21.1.135", missing the closing '>'), ast_callerid_parse will fail and then location variable is leaved as NULL pointer which cause segment fault.


--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.asterisk.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira