[asterisk-bugs] [JIRA] (ASTERISK-23720) res_pjsip_incoming_blind_request: crash with NULL session channel

[Rusty Newton (JIRA)]

Rusty Newton created ASTERISK-23720:
---------------------------------------

             Summary: res_pjsip_incoming_blind_request: crash with NULL session channel
                 Key: ASTERISK-23720
                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-23720
             Project: Asterisk
          Issue Type: Bug
      Security Level: None
          Components: Channels/chan_pjsip, Resources/res_pjsip_refer
    Affects Versions: 12.2.0
            Reporter: Jonathan Rose


I've only been able to reproduce this with Digium Phones on account of them offering a certain level of control over calls during transfers. Still, Asterisk shouldn't crash on any SIP transactions it receives.

extension:

<something to dial the other phone with>
001,1,Wait(20)
001,n,Answer()

steps to reproduce:

* PJSIP/dphone1 dials PJSIP/dphone2, gets into normal 2 party bridge situation
* PJSIP/dphone1 uses xfer key to transfer PJSIP/dphone2 to extension 001
* While the transfer is progressing, press the ^ key on the Digium Phone's directional pad to switch the call from the current transfer to the initial session with PJSIP/dphone2
* Attempt to transfer the call to 001 again. This should cause the crash.

I'm attaching a backtrace which details the crash. It can be mitigated simply by adding a null check against session->channel and returning 404 (probably anything other than 200 really). I'm not attaching a patch since I think that might be a superficial fix.



--
This message was sent by Atlassian JIRA
(v6.2#6252)