[asterisk-bugs] [JIRA] (ASTERISK-23718) res_pjsip_incoming_blind_request: crash with NULL session channel

[Jonathan Rose (JIRA)]

Jonathan Rose created ASTERISK-23718:
----------------------------------------

             Summary: res_pjsip_incoming_blind_request: crash with NULL session channel
                 Key: ASTERISK-23718
                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-23718
             Project: Asterisk
          Issue Type: Bug
      Security Level: None
          Components: Channels/chan_pjsip, Resources/res_pjsip_refer
    Affects Versions: 12.2.0
            Reporter: Jonathan Rose
         Attachments: backtrace_pjsip_blind_xfer_crash.txt

I've only been able to reproduce this with Digium Phones on account of them offering a certain level of control over calls during transfers. Still, Asterisk shouldn't crash on any SIP transactions it receives.

extension:

<something to dial the other phone with>
001,1,Wait(20)
001,n,Answer()

steps to reproduce:

* PJSIP/dphone1 dials PJSIP/dphone2, gets into normal 2 party bridge situation
* PJSIP/dphone1 uses xfer key to transfer PJSIP/dphone2 to extension 001
* While the transfer is progressing, press the ^ key on the Digium Phone's directional pad to switch the call from the current transfer to the initial session with PJSIP/dphone2
* Attempt to transfer the call to 001 again. This should cause the crash.

I'm attaching a backtrace which details the crash. It can be mitigated simply by adding a null check against session->channel and returning 404 (probably anything other than 200 really). I'm not attaching a patch since I think that might be a superficial fix.



--
This message was sent by Atlassian JIRA
(v6.2#6252)