sr-dev April 2011

sr-dev@lists.kamailio.org

27 participants
271 discussions

by Klaus Darilion

Hi! Carsten, Jason, I wonder what is the main motivation for you to have IMS components? Are you using Kamailio in an mobile operator environment and thus have to support all the IMS interfaces, or do you plan to use those modules also in "normal" VoIP provider scenarios (benefits?) Thanks Klaus

13 years, 2 months

git:master: modules_k/nathelper: add_contact_alias adds <> s around contact URI

by Juha Heinanen

Module: sip-router Branch: master Commit: 3ff9594a30eff2d18e6ea0595c5f82f878eaca1c URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=3ff9594… Author: Juha Heinanen <jh(a)tutpro.com> Committer: Juha Heinanen <jh(a)tutpro.com> Date: Fri Nov 26 10:37:30 2010 +0200 modules_k/nathelper: add_contact_alias adds <>s around contact URI Make sure that Contact URI is surrounded by <> when adding ;alias parameter. Otherwise, ;alias parameter may be interpreted as header parameter, because the syntax seems to be ambiguous. (cherry picked from commit f5ef15fee0c3bf09adf2506effa0895f72af9034) --- modules_k/nathelper/nathelper.c | 69 +++++++++++++++++++++++++++++++------- 1 files changed, 56 insertions(+), 13 deletions(-) diff --git a/modules_k/nathelper/nathelper.c b/modules_k/nathelper/nathelper.c index 51c1086..52c5e5f 100644 --- a/modules_k/nathelper/nathelper.c +++ b/modules_k/nathelper/nathelper.c @@ -786,7 +786,7 @@ add_contact_alias_f(struct sip_msg* msg, char* str1, char* str2) struct lump *anchor; struct sip_uri uri; struct ip_addr *ip; - char *param, *at, *port, *start; + char *lt, *gt, *param, *at, *port, *start; /* Do nothing if Contact header does not exist */ if (!msg->contact) { @@ -816,25 +816,63 @@ add_contact_alias_f(struct sip_msg* msg, char* str1, char* str2) return 2; } - /* Add alias param */ + /* Check if function has been called already */ if ((c->uri.s < msg->buf) || (c->uri.s > (msg->buf + msg->len))) { LM_ERR("you can't call alias_contact twice, check your config!\n"); return -1; } + + /* Check if Contact URI needs to be enclosed in <>s */ + lt = gt = param = NULL; + at = memchr(msg->contact->body.s, '<', msg->contact->body.len); + if (at == NULL) { + lt = (char*)pkg_malloc(1); + if (!lt) { + LM_ERR("no pkg memory left for lt sign\n"); + goto err; + } + *lt = '<'; + anchor = anchor_lump(msg, msg->contact->body.s - msg->buf, 0, 0); + if (anchor == NULL) { + LM_ERR("anchor_lump for beginning of contact body failed\n"); + goto err; + } + if (insert_new_lump_before(anchor, lt, 1, 0) == 0) { + LM_ERR("insert_new_lump_before for \"<\" failed\n"); + goto err; + } + gt = (char*)pkg_malloc(1); + if (!gt) { + LM_ERR("no pkg memory left for gt sign\n"); + goto err; + } + *gt = '>'; + anchor = anchor_lump(msg, msg->contact->body.s + + msg->contact->body.len - msg->buf, 0, 0); + if (anchor == NULL) { + LM_ERR("anchor_lump for end of contact body failed\n"); + goto err; + } + if (insert_new_lump_before(anchor, gt, 1, 0) == 0) { + LM_ERR("insert_new_lump_before for \">\" failed\n"); + goto err; + } + } + + /* Create ;alias param */ param_len = SALIAS_LEN + IP6_MAX_STR_SIZE + 1 /* ~ */ + 5 /* port */ + 1 /* ~ */ + 1 /* proto */; param = (char*)pkg_malloc(param_len); if (!param) { LM_ERR("no pkg memory left for alias param\n"); - return -1; + goto err; } at = param; append_str(at, SALIAS, SALIAS_LEN); ip_len = ip_addr2sbuf(&(msg->rcv.src_ip), at, param_len - SALIAS_LEN); if (ip_len <= 0) { - pkg_free(param); LM_ERR("failed to copy source ip\n"); - return -1; + goto err; } at = at + ip_len; append_chr(at, '~'); @@ -842,9 +880,8 @@ add_contact_alias_f(struct sip_msg* msg, char* str1, char* str2) append_str(at, port, len); append_chr(at, '~'); if ((msg->rcv.proto < PROTO_UDP) || (msg->rcv.proto > PROTO_SCTP)) { - pkg_free(param); LM_ERR("invalid transport protocol\n"); - return -1; + goto err; } append_chr(at, msg->rcv.proto + '0'); param_len = at - param; @@ -854,18 +891,24 @@ add_contact_alias_f(struct sip_msg* msg, char* str1, char* str2) } else { start = uri.host.s + uri.host.len; } + + /* Add ;alias param */ anchor = anchor_lump(msg, start - msg->buf, 0, 0); if (anchor == NULL) { - pkg_free(param); - LM_ERR("anchor_lump failed\n"); - return -1; + LM_ERR("anchor_lump for ;alias param failed\n"); + goto err; } if (insert_new_lump_after(anchor, param, param_len, 0) == 0) { - LM_ERR("insert_new_lump_after failed\n"); - pkg_free(param); - return -1; + LM_ERR("insert_new_lump_after for ;alias param failed\n"); + goto err; } return 1; + + err: + if (lt) pkg_free(lt); + if (gt) pkg_free(gt); + if (param) pkg_free(param); + return -1; }

13 years, 3 months

git:master: modules/tm: new implementation of load_contacts()/next_contacts ()

by Juha Heinanen

Module: sip-router Branch: master Commit: e973bbe5e7310861f77b17ce0afaf1cca35fe48a URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=e973bbe… Author: Juha Heinanen <jh(a)tutpro.com> Committer: Juha Heinanen <jh(a)tutpro.com> Date: Fri May 28 15:38:41 2010 +0300 modules/tm: new implementation of load_contacts()/next_contacts() - Simpler implementation of load_contacts()/next_contacts() functions based on recent changes related to Request-URI handling. - Function next_contacts() does not anymore set any timers. Check contact_avp and call t_set_fr() before calling t_relay() instead. - Removed fr_timer_next module parameter, because it is not needed anymore. --- modules/tm/README | 255 ++++++++++++++------------------------ modules/tm/doc/functions.xml | 51 +++----- modules/tm/doc/params.xml | 73 ----------- modules/tm/doc/tm.xml | 15 +-- modules/tm/t_serial.c | 279 ++++++++++++------------------------------ modules/tm/tm.c | 1 - 6 files changed, 190 insertions(+), 484 deletions(-) Diff: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commitdiff;h=e97…

13 years, 4 months

git:master: core: pkg mem size configurable form the cmd line

by Andrei Pelinescu-Onciul

Module: sip-router Branch: master Commit: 7b3a6eca7bb6dd1ca2a1395ca1e5821808ec85cd URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=7b3a6ec… Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org> Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org> Date: Tue Apr 12 21:54:07 2011 +0200 core: pkg mem size configurable form the cmd line The pkg mem size used can be configured by using the "-M" parameter on the command line, e.g.: ser -M 8 -f test.cfg # start ser with 8mb of pkg memory The default remains 4Mb. --- globals.h | 1 + main.c | 83 ++++++++++++++++++++++++++++++++++++++++++++---------------- mem/mem.c | 36 +++++++++++++++++++++----- mem/mem.h | 3 +- 4 files changed, 93 insertions(+), 30 deletions(-) diff --git a/globals.h b/globals.h index 40f7214..8b3a81d 100644 --- a/globals.h +++ b/globals.h @@ -150,6 +150,7 @@ extern int cfg_warnings; extern unsigned int msg_no; extern unsigned long shm_mem_size; +extern unsigned long pkg_mem_size; /* AVP configuration */ extern char *avp_db_url; /* db url used by user preferences (AVPs) */ diff --git a/main.c b/main.c index fcc25ae..d525fb4 100644 --- a/main.c +++ b/main.c @@ -245,6 +245,7 @@ Options:\n\ -b nr Maximum receive buffer size which will not be exceeded by\n\ auto-probing procedure even if OS allows\n\ -m nr Size of shared memory allocated in Megabytes\n\ + -M nr Size of private memory allocated, in Megabytes\n\ -w dir Change the working directory to \"dir\" (default: \"/\")\n\ -t dir Chroot to \"dir\"\n\ -u uid Change uid \n\ @@ -273,7 +274,7 @@ void print_ct_constants() #endif */ printf("MAX_RECV_BUFFER_SIZE %d, MAX_LISTEN %d," - " MAX_URI_SIZE %d, BUF_SIZE %d, PKG_SIZE %uMB\n", + " MAX_URI_SIZE %d, BUF_SIZE %d, DEFAULT PKG_SIZE %uMB\n", MAX_RECV_BUFFER_SIZE, MAX_LISTEN, MAX_URI_SIZE, BUF_SIZE, PKG_MEM_SIZE); #ifdef USE_TCP @@ -488,6 +489,8 @@ int cfg_warnings=0; /* shared memory (in MB) */ unsigned long shm_mem_size=0; +/* private (pkg) memory (in MB) */ +unsigned long pkg_mem_size=0; /* export command-line to anywhere else */ int my_argc; @@ -590,6 +593,7 @@ void cleanup(show_status) destroy_lock_ops(); if (pid_file) unlink(pid_file); if (pgid_file) unlink(pgid_file); + destroy_pkg_mallocs(); } @@ -1750,7 +1754,52 @@ int main(int argc, char** argv) dont_fork_cnt=0; daemon_status_init(); - /*init pkg mallocs (before parsing cfg or cmd line !)*/ + /* command line options */ + options= ":f:cm:M:dVhEb:l:L:n:vrRDTN:W:w:t:u:g:P:G:SQ:O:a:A:" +#ifdef STATS + "s:" +#endif + ; + /* Handle special command line arguments, that must be treated before + * intializing the various subsystem or before parsing other arguments: + * - get the startup debug and log_stderr values + * - look if pkg mem size is overriden on the command line (-M) and get + * the new value here (before intializing pkg_mem). + * - look if there is a -h, e.g. -f -h construction won't be caught + * later + */ + opterr = 0; + while((c=getopt(argc,argv,options))!=-1) { + switch(c) { + case 'd': + debug_flag = 1; + default_core_cfg.debug++; + break; + case 'E': + log_stderr=1; + break; + case 'M': + pkg_mem_size=strtol(optarg, &tmp, 10) * 1024 * 1024; + if (tmp &&(*tmp)){ + fprintf(stderr, "bad private mem size number: -M %s\n", + optarg); + goto error; + }; + break; + default: + if (c == 'h' || (optarg && strcmp(optarg, "-h") == 0)) { + printf("version: %s\n", full_version); + printf("%s",help_msg); + exit(0); + } + break; + } + } + + /*init pkg mallocs (before parsing cfg or the rest of the cmd line !)*/ + if (pkg_mem_size) + LOG(L_INFO, " private (per process) memory: %ld bytes\n", + pkg_mem_size ); if (init_pkg_mallocs()==-1) goto error; @@ -1759,11 +1808,6 @@ int main(int argc, char** argv) "DBG_MSG_QA enabled, ser may exit abruptly\n"); #endif - options= ":f:cm:dVhEb:l:L:n:vrRDTN:W:w:t:u:g:P:G:SQ:O:a:A:" -#ifdef STATS - "s:" -#endif - ; /* init counters / stats */ if (init_counters() == -1) goto error; @@ -1773,16 +1817,6 @@ int main(int argc, char** argv) #ifdef USE_SCTP init_sctp_options(); /* set defaults before the config */ #endif - /* look if there is a -h, e.g. -f -h construction won't catch it later */ - opterr = 0; - while((c=getopt(argc,argv,options))!=-1) { - if (c == 'h' || (optarg && strcmp(optarg, "-h") == 0)) { - printf("version: %s\n", full_version); - printf("%s",help_msg); - exit(0); - break; - } - } /* process command line (cfg. file path etc) */ optind = 1; /* reset getopt */ /* switches required before script processing */ @@ -1808,9 +1842,12 @@ int main(int argc, char** argv) LOG(L_INFO, "ser: shared memory: %ld bytes\n", shm_mem_size ); break; + case 'M': + /* ignore it, it was parsed immediately after startup, + the pkg mem. is already initialized at this point */ + break; case 'd': - debug_flag = 1; - default_core_cfg.debug++; + /* ignore it, was parsed immediately after startup */ break; case 'V': printf("version: %s\n", full_version); @@ -1829,7 +1866,7 @@ int main(int argc, char** argv) exit(0); break; case 'E': - log_stderr=1; + /* ignore it, was parsed immediately after startup */ break; case 'O': scr_opt_lev=strtol(optarg, &tmp, 10); @@ -1974,6 +2011,7 @@ try_again: case 'f': case 'c': case 'm': + case 'M': case 'd': case 'V': case 'h': @@ -1981,7 +2019,8 @@ try_again: case 'A': break; case 'E': - log_stderr=1; // use in both getopt switches + log_stderr=1; /* use in both getopt switches, + takes priority over config */ break; case 'b': maxbuffer=strtol(optarg, &tmp, 10); @@ -2322,7 +2361,7 @@ try_again: } if (disable_core_dump) set_core_dump(0, 0); - else set_core_dump(1, shm_mem_size+PKG_MEM_POOL_SIZE+4*1024*1024); + else set_core_dump(1, shm_mem_size+pkg_mem_size+4*1024*1024); if (open_files_limit>0){ if(increase_open_fds(open_files_limit)<0){ fprintf(stderr, "ERROR: error could not increase file limits\n"); diff --git a/mem/mem.c b/mem/mem.c index a2f1b9a..1180a2a 100644 --- a/mem/mem.c +++ b/mem/mem.c @@ -26,6 +26,7 @@ #include <stdio.h> +#include <stdlib.h> #include "../config.h" #include "../dprint.h" #include "../globals.h" @@ -41,15 +42,15 @@ #ifdef PKG_MALLOC #ifndef DL_MALLOC - char mem_pool[PKG_MEM_POOL_SIZE]; + char* mem_pool = 0; #endif #ifdef F_MALLOC - struct fm_block* mem_block; + struct fm_block* mem_block = 0; #elif defined DL_MALLOC /* don't need this */ #else - struct qm_block* mem_block; + struct qm_block* mem_block = 0; #endif #endif @@ -58,18 +59,25 @@ int init_pkg_mallocs() { #ifdef PKG_MALLOC /*init mem*/ + #ifndef DL_MALLOC + if (pkg_mem_size == 0) + pkg_mem_size = PKG_MEM_POOL_SIZE; + mem_pool = malloc(pkg_mem_size); + #endif #ifdef F_MALLOC - mem_block=fm_malloc_init(mem_pool, PKG_MEM_POOL_SIZE); + if (mem_pool) + mem_block=fm_malloc_init(mem_pool, pkg_mem_size); #elif DL_MALLOC /* don't need this */ #else - mem_block=qm_malloc_init(mem_pool, PKG_MEM_POOL_SIZE); + if (mem_pool) + mem_block=qm_malloc_init(mem_pool, pkg_mem_size); #endif #ifndef DL_MALLOC if (mem_block==0){ LOG(L_CRIT, "could not initialize memory pool\n"); - fprintf(stderr, "Too much pkg memory demanded: %d\n", - PKG_MEM_POOL_SIZE ); + fprintf(stderr, "Too much pkg memory demanded: %ld bytes\n", + pkg_mem_size); return -1; } #endif @@ -79,6 +87,20 @@ int init_pkg_mallocs() +void destroy_pkg_mallocs() +{ +#ifdef PKG_MALLOC + #ifndef DL_MALLOC + if (mem_pool) { + free(mem_pool); + mem_pool = 0; + } + #endif +#endif /* PKG_MALLOC */ +} + + + int init_shm_mallocs(int force_alloc) { #ifdef SHM_MEM diff --git a/mem/mem.h b/mem/mem.h index aed1442..510698a 100644 --- a/mem/mem.h +++ b/mem/mem.h @@ -58,7 +58,7 @@ extern struct qm_block* mem_block; # endif - extern char mem_pool[PKG_MEM_POOL_SIZE]; + extern char* mem_pool; # ifdef DBG_QM_MALLOC @@ -133,6 +133,7 @@ #endif int init_pkg_mallocs(); +void destroy_pkg_mallocs(); int init_shm_mallocs(int force_alloc); /*! generic logging helper for allocation errors in private memory pool/ system */

13 years, 5 months

lockup("location") doesn't find a "sip" registration if RURI scheme is "sips"

by Iñaki Baz Castillo

Hi, "sip:alice@domain.org" is registered in Kamailio. If the proxy receives a request for "sips:alice@domain.org" and invokes "lookup(location)" the function doesn't retrieve the registration of alice. But it should: RFC 5630 section 3.3: When used as the Request-URI of a request, the SIPS scheme signifies that each hop over which the request is forwarded, until the request reaches the SIP entity responsible for the domain portion of the Request-URI, must be secured with TLS; once it reaches the domain in question it is handled in accordance with local security and routing policy, quite possibly using TLS for any last hop to a UAS. When used by the originator of a request (as would be the case if they employed a SIPS URI as the address- of-record of the target), SIPS dictates that the entire request path to the target domain be so secured. Note the last phrase: When used by the originator of a request (as would be the case if they employed a SIPS URI as the address- of-record of the target), SIPS dictates that the entire request path to the target domain be so secured. This is, the entire path *until* the proxy responsible for the domain in the RURI must be secure (TLS) but it's not required (local policy) that the destination proxy dellivers the request to the destination user using TLS. So IMHO lockup(location) should not inspect the registration schema. Am I wrong? -- Iñaki Baz Castillo <ibc(a)aliax.net>

13 years, 7 months

Fwd: crash & 100% CPU usage problem with kamailio 3.1.2

by Zunnun

---------- Forwarded message ---------- From: Zunnun <zunnun(a)gmail.com> Date: Wed, Mar 30, 2011 at 10:51 AM Subject: crash & 100% CPU usage problem with kamailio 3.1.2 To: sr-dev(a)lists.sip-router.org *kamailio 3.1.2 issues* *Problem 1:* Running heavy stress (for few hours), we have seen 100 % CPU usage Reason: the linked list is circular. next pointer points itself & the loop never breaks. file: tcp_main.c function: inline static int _tcpconn_add_alias_unsafe(struct tcp_connection* c, int port,struct ip_addr* l_ip, int l_port,int flags) for (a=tcpconn_aliases_hash[hash], nxt=0; a; a=nxt){ nxt=a->next; here a->next points to a & loop never breaks *Problem 2: * kamailio process terminates (heavy stress for over 24 hours) Reason: it calls abort() file: tcp_main.c function inline static int tcpconn_chld_put(struct tcp_connection* tcpconn) { if (unlikely(atomic_dec_and_test(&tcpconn->refcnt))){ DBG("tcpconn_chld_put: destroying connection %p (%d, %d) " "flags %04x\n", tcpconn, tcpconn->id, tcpconn->s, tcpconn->flags); /* sanity checks */ membar_read_atomic_op(); /* make sure we see the current flags */ if (unlikely(!(tcpconn->flags & F_CONN_FD_CLOSED) || (tcpconn->flags & (F_CONN_HASHED|F_CONN_MAIN_TIMER| F_CONN_READ_W|F_CONN_WRITE_W)) )){ LOG(L_CRIT, "BUG: tcpconn_chld_put: %p bad flags = %0x\n", tcpconn, tcpconn->flags); abort(); //CALLS abort } _tcpconn_free(tcpconn); /* destroys also the wbuf_q if still present*/ return 1; } return 0; } *Problem 3: * kamailio crashed (heavy stress, seen it twice after 4 days 8 hours) Reason: Circular link list is bad, prev pointer is NULL & kamailio access it #0 local_timer_list_expire (lt=0x82eea0, saved_ticks=1295476481) at local_timer.c:221 221 _timer_rm_list(tl); /* detach */ (gdb) bt #0 local_timer_list_expire (lt=0x82eea0, saved_ticks=1295476481) at local_timer.c:221 #1 local_timer_expire (lt=0x82eea0, saved_ticks=1295476481) at local_timer.c:250 #2 local_timer_run (lt=0x82eea0, saved_ticks=1295476481) at local_timer.c:274 #3 0x0000000000510c3e in tcp_timer_run () at tcp_main.c:4384 #4 tcp_main_loop () at tcp_main.c:4564 #5 0x0000000000469eba in main_loop () at main.c:1641 #6 0x000000000046c04f in main (argc=<value optimized out>, argv=0x7fff3d28a3c8) at main.c:2398 (gdb) print tl $1 = <value optimized out> (gdb) print h $2 = (struct timer_head *) 0x855eb8 (gdb) print *h $3 = {next = 0x0, prev = 0x2acbac5398b8} (gdb) print *h->prev $4 = {next = 0x0, prev = 0x855eb8, expire = 1295476481, initial_timeout = 1920, data = 0x2acbac5397d0, f = 0x4f8310 <tcpconn_main_timeout>, flags = 512, slow_idx = 0} (gdb) once prev pointer was NULL & next crash next pointer was NULL *Problem 4:* kamailio process terminated (heavy stress, found it twice, after 16 hours) Reason: it calls abort() file : mem/q_malloc.c function void qm_free(struct qm_block* qm, void* p) partial code: #ifdef DBG_QM_MALLOC qm_debug_frag(qm, f); if (f->u.is_free){ LOG(L_CRIT, "BUG: qm_free: freeing already freed pointer," " first free: %s: %s(%ld) - aborting\n", f->file, f->func, f->line); abort(); //CALLS ABORT } MDBG("qm_free: freeing frag. %p alloc'ed from %s: %s(%ld)\n", f, f->file, f->func, f->line); #endif *problem 5*: infinite loop - log file is full of these messages 100% CPU at that time /kamailio[21562]: : <core> [io_wait.h:617]: BUG: io_watch_del: invalid fd -1, not in [0, 2) //kamailio[21562]: : <core> [tcp_read.c:1218]: ERROR: tcpconn_receive: handle_io: io_watch_del failed for 0x2acbac5397d0

13 years, 8 months

New module ipops

by Iñaki Baz Castillo

Hi, I've commited a new module named 'ipops' which provides operations with IPv4 and IPv6: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=5940394… The README describes the module functions: http://git.sip-router.org/cgi-bin/gitweb.cgi?p=sip-router;a=blob;f=modules/… The module has no dependecies on other siprouter modules or external libraries, so if it's ok for you it could be enabled by default. Cheers. -- Iñaki Baz Castillo <ibc(a)aliax.net>

13 years, 8 months

git:master: - ipops module: fix in documentation.

by I�aki Baz Castillo

Module: sip-router Branch: master Commit: 422f81d42d3d4d548729f1959c8fb4072328605e URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=422f81d… Author: Iñaki Baz Castillo <ibc(a)aliax.net> Committer: Iñaki Baz Castillo <ibc(a)aliax.net> Date: Sat Apr 30 16:15:56 2011 +0200 - ipops module: fix in documentation. --- modules/ipops/README | 4 +- modules/ipops/doc/ipops_admin.xml | 16 +- modules/ipops/ip_parser.c | 384 ++++++++++++++++++------------------- modules/ipops/ip_parser.rl | 2 - 4 files changed, 198 insertions(+), 208 deletions(-) Diff: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commitdiff;h=422…

13 years, 8 months

[tracker] Comment added: Segfault parsing STUN body

by sip-router

THIS IS AN AUTOMATED MESSAGE, DO NOT REPLY. The following task has a new comment added: FS#129 - Segfault parsing STUN body User who did this - Andrei Pelinescu-Onciul (andrei) ---------- Thanks a lot, it should be fixed on the latest git (both 3.1 and master branches). See Git#725c8d7 and Git#66af75fc. Could you retry with STUN enabled? ---------- More information can be found at the following URL: http://sip-router.org/tracker/index.php?do=details&task_id=129#comment206 You are receiving this message because you have requested it from the Flyspray bugtracking system. If you did not expect this message or don't want to receive mails in future, you can change your notification settings at the URL shown above.

13 years, 8 months

git:3.1: stun: fix attribute padded length outside the packet case

by Andrei Pelinescu-Onciul

Module: sip-router Branch: 3.1 Commit: 725c8d7318c76e322a8eeef5423436347f56214d URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=725c8d7… Author: Andrei Pelinescu-Onciul <andrei(a)iptel.org> Committer: Andrei Pelinescu-Onciul <andrei(a)iptel.org> Date: Sat Apr 30 00:11:02 2011 +0200 stun: fix attribute padded length outside the packet case - check if the attribute padded length points still inside the packet (only the un-padded value was checked before) - use an integer and not an UINT for the remainder part of the packet - fix padded length computation in copy_str_to_buffer() Closes: FS#129 Reported-by: Francesco Castellano (cherry picked from commit 677a7bfabd0a266ebdd712b23caee75198993e4a) --- ser_stun.c | 11 +++++++++-- 1 files changed, 9 insertions(+), 2 deletions(-) diff --git a/ser_stun.c b/ser_stun.c index 6957a88..879a7ef 100644 --- a/ser_stun.c +++ b/ser_stun.c @@ -224,7 +224,7 @@ int stun_parse_body( struct stun_unknown_att** unknown, USHORT_T* error_code) { - UINT_T not_parsed; + int not_parsed; struct stun_attr attr; USHORT_T attr_size; UINT_T padded_len; @@ -384,6 +384,13 @@ int stun_parse_body( padded_len = ntohs(attr.len); break; } + + /* check if there is enough unparsed space for the padded attribute + (the padded length might be greater then the attribute length) + */ + if (not_parsed < padded_len) { + break; + } buf += padded_len; not_parsed -= padded_len; } /* while */ @@ -772,7 +779,7 @@ int copy_str_to_buffer(struct stun_msg* res, const char* data, UINT_T pad) data_len = strlen(data); memset(&empty, 0, pad); - pad_len = pad - data_len%pad; + pad_len = (pad - data_len%pad) % pad; if (buf_copy(&res->msg, (void *) data, sizeof(UCHAR_T)*data_len) != 0) { #ifdef EXTRA_DEBUG

13 years, 8 months

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev April 2011