[asterisk-bugs] [JIRA] (ASTERISK-27046) res_pjsip_transport_websocket: segfault in get_write_timeout

[George Joseph (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-27046?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

George Joseph updated ASTERISK-27046:
-------------------------------------

    Target Release Version/s: 13.17.0

> res_pjsip_transport_websocket: segfault in get_write_timeout
> ------------------------------------------------------------
>
>                 Key: ASTERISK-27046
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-27046
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Resources/res_pjsip_transport_websocket
>    Affects Versions: 14.5.0
>         Environment: linux x64
>            Reporter: Jørgen H
>            Severity: Critical
>      Target Release: 13.17.0
>
>
> Segfault due to missing check for NULL return value when calling ast_sorcery_retrieve_by_id in function get_write_timeout.
> Happens using Chromium 61, but not Firefox.. so depends on the client.
> {noformat}
> #0  get_write_timeout () at res_pjsip_transport_websocket.c:312
>         __a = -1
>         __b = <error reading variable __b (Cannot access memory at address 0x390)>
>         transport = 0x0
>         it_transport_states = {c = 0x7fc8f4001e18, last_node = 0x7fc8f4002290, complete = 0, flags = 0}
>         transport_state = 0x1986a48
>         write_timeout = -1
>         transport_states = 0x7fc8f4001e18
> #1  websocket_cb (session=0x7fc8f4013a08, parameters=<optimized out>, headers=<optimized out>) at res_pjsip_transport_websocket.c:349
>         create_data = {transport = 0x7fc92dff4b00, ws_session = 0x1a91788}
>         transport = <optimized out>
>         read_data = {transport = 0x7fc8f4001e18, payload = 0x7fc8f4002290 "Hj\230\001", payload_len = 0}
>         __PRETTY_FUNCTION__ = "websocket_cb"
> {noformat}



--
This message was sent by Atlassian JIRA
(v6.2#6252)