[Asterisk-code-review] res_pjsip_session: Fixed wrong session termination (asterisk[13])

[Joshua Colp]

Joshua Colp has submitted this change. ( https://gerrit.asterisk.org/c/asterisk/+/13900 )

Change subject: res_pjsip_session: Fixed wrong session termination
......................................................................

res_pjsip_session: Fixed wrong session termination

When the Asterisk receives 200 OK with invalid SDP,
the Asterisk/PJPROJECT terminating the session.
But if the channel was in the Bridge, Asterisk tries send
the Re-Invite before terminating the session.
And when the Asterisk sending the Re-Invite, it doesn't check
the SDP is NULL or not. This crashes the Asterisk.

Fixed it to close the session correctly if the UAS sends the
200 OK with wrong SDP.

ASTERISK-28743

Change-Id: Ifa864e0e125b1a7ed2f3abd4164187e1dddc56da
---
M res/res_pjsip_session.c
1 file changed, 23 insertions(+), 5 deletions(-)

Approvals:
  Joshua Colp: Looks good to me, approved; Approved for Submit
  George Joseph: Looks good to me, but someone else must approve



diff --git a/res/res_pjsip_session.c b/res/res_pjsip_session.c
index b61b0fd..02c1a77 100644
--- a/res/res_pjsip_session.c
+++ b/res/res_pjsip_session.c
@@ -27,6 +27,7 @@
 #include <pjsip.h>
 #include <pjsip_ua.h>
 #include <pjlib.h>
+#include <pjmedia.h>
 
 #include "asterisk/res_pjsip.h"
 #include "asterisk/res_pjsip_session.h"
@@ -2830,6 +2831,28 @@
 						}
 					}
 				} else if (tsx->state == PJSIP_TSX_STATE_TERMINATED) {
+					if (!inv->cancelling
+						&& inv->role == PJSIP_ROLE_UAC
+						&& inv->state == PJSIP_INV_STATE_CONFIRMED
+						&& pjmedia_sdp_neg_was_answer_remote(inv->neg)
+						&& pjmedia_sdp_neg_get_state(inv->neg) == PJMEDIA_SDP_NEG_STATE_DONE
+						&& (session->channel && ast_channel_hangupcause(session->channel) == AST_CAUSE_BEARERCAPABILITY_NOTAVAIL)
+						) {
+						/*
+						 * We didn't send a CANCEL but the UAS sent us the 200 OK with an invalid or unacceptable codec SDP.
+						 * In this case the SDP negotiation is incomplete and PJPROJECT has already sent the ACK.
+						 * So, we send the BYE with 503 status code here. And the actual hangup cause code is already set
+						 * to AST_CAUSE_BEARERCAPABILITY_NOTAVAIL by the session_inv_on_media_update(), setting the 503
+						 * status code doesn't affect to hangup cause code.
+						 */
+						ast_debug(1, "Endpoint '%s(%s)': Ending session due to 200 OK with incomplete SDP negotiation.  %s\n",
+							ast_sorcery_object_get_id(session->endpoint),
+							session->channel ? ast_channel_name(session->channel) : "",
+							pjsip_rx_data_get_info(e->body.tsx_state.src.rdata));
+						pjsip_inv_end_session(session->inv_session, 503, NULL, &tdata);
+						return;
+					}
+
 					if (inv->cancelling && tsx->status_code == PJSIP_SC_OK) {
 						int sdp_negotiation_done =
 							pjmedia_sdp_neg_get_state(inv->neg) == PJMEDIA_SDP_NEG_STATE_DONE;
@@ -2848,11 +2871,6 @@
 						 * UAS sent us an invalid SDP with the 200 OK.  In this case
 						 * the SDP negotiation is incomplete and PJPROJECT has
 						 * already sent the BYE for us because of the invalid SDP.
-						 *
-						 * 3) We didn't send a CANCEL but the UAS sent us an invalid
-						 * SDP with the 200 OK.  In this case the SDP negotiation is
-						 * incomplete and PJPROJECT has already sent the BYE for us
-						 * because of the invalid SDP.
 						 */
 						ast_test_suite_event_notify("PJSIP_SESSION_CANCELED",
 							"Endpoint: %s\r\n"

-- 
To view, visit https://gerrit.asterisk.org/c/asterisk/+/13900
To unsubscribe, or for help writing mail filters, visit https://gerrit.asterisk.org/settings

Gerrit-Project: asterisk
Gerrit-Branch: 13
Gerrit-Change-Id: Ifa864e0e125b1a7ed2f3abd4164187e1dddc56da
Gerrit-Change-Number: 13900
Gerrit-PatchSet: 4
Gerrit-Owner: sungtae kim <pchero21 at gmail.com>
Gerrit-Reviewer: Benjamin Keith Ford <bford at digium.com>
Gerrit-Reviewer: Friendly Automation
Gerrit-Reviewer: George Joseph <gjoseph at digium.com>
Gerrit-Reviewer: Joshua Colp <jcolp at sangoma.com>
Gerrit-MessageType: merged
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-code-review/attachments/20200325/9aa4e96e/attachment-0001.html>