[asterisk-bugs] [JIRA] (ASTERISK-27046) segfault res_pjsip_transport_websocket.c get_write_timeout

[Jørgen H (JIRA)]

Jørgen H created ASTERISK-27046:
-----------------------------------

             Summary: segfault res_pjsip_transport_websocket.c get_write_timeout
                 Key: ASTERISK-27046
                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-27046
             Project: Asterisk
          Issue Type: Bug
      Security Level: None
          Components: Resources/res_pjsip_transport_websocket
    Affects Versions: 14.5.0
         Environment: linux x64
            Reporter: Jørgen H
            Severity: Critical


Segfault due to missing check for NULL return value when calling ast_sorcery_retrieve_by_id in function get_write_timeout.

Happens using Chromium 61, but not Firefox.. so depends on the client.


#0  get_write_timeout () at res_pjsip_transport_websocket.c:312
        __a = -1
        __b = <error reading variable __b (Cannot access memory at address 0x390)>
        transport = 0x0
        it_transport_states = {c = 0x7fc8f4001e18, last_node = 0x7fc8f4002290, complete = 0, flags = 0}
        transport_state = 0x1986a48
        write_timeout = -1
        transport_states = 0x7fc8f4001e18
#1  websocket_cb (session=0x7fc8f4013a08, parameters=<optimized out>, headers=<optimized out>) at res_pjsip_transport_websocket.c:349
        create_data = {transport = 0x7fc92dff4b00, ws_session = 0x1a91788}
        transport = <optimized out>
        read_data = {transport = 0x7fc8f4001e18, payload = 0x7fc8f4002290 "Hj\230\001", payload_len = 0}
        __PRETTY_FUNCTION__ = "websocket_cb"




--
This message was sent by Atlassian JIRA
(v6.2#6252)