[sr-dev] git:master:78ccdb7f: topoh: improve checks for via header processing

Module: kamailio Branch: master Commit: 78ccdb7ff1ebc34748092fe01ff249f5eeb661c8 URL: https://github.com/kamailio/kamailio/commit/78ccdb7ff1ebc34748092fe01ff249f… Author: Henning Westerholt &lt;hw(a)kamailio.org&gt; Committer: Henning Westerholt &lt;hw(a)kamailio.org&gt; Date: 2019-02-24T21:25:25+01:00 topoh: improve checks for via header processing --- Modified: src/modules/topoh/th_mask.c Modified: src/modules/topoh/th_msg.c --- Diff: https://github.com/kamailio/kamailio/commit/78ccdb7ff1ebc34748092fe01ff249f… Patch: https://github.com/kamailio/kamailio/commit/78ccdb7ff1ebc34748092fe01ff249f… --- diff --git a/src/modules/topoh/th_mask.c b/src/modules/topoh/th_mask.c index 2c0d1aa24f..fce9255f20 100644 --- a/src/modules/topoh/th_mask.c +++ b/src/modules/topoh/th_mask.c @@ -141,6 +141,12 @@ char* th_mask_decode(char *in, int ilen, str *prefix, int extra, int *olen) *olen = (((ilen-((prefix!=NULL&&prefix->len>0)?prefix->len:0)) * 6) >> 3) - n; + + if (*olen<=0) { + LM_ERR("invalid olen parameter calculated, can't continue %d\n", *olen); + return NULL; + } + out = (char*)pkg_malloc((*olen+1+extra)*sizeof(char)); if(out==NULL) diff --git a/src/modules/topoh/th_msg.c b/src/modules/topoh/th_msg.c index 142eda1580..a3b6ab5f29 100644 --- a/src/modules/topoh/th_msg.c +++ b/src/modules/topoh/th_msg.c @@ -419,7 +419,7 @@ int th_unmask_via(sip_msg_t *msg, str *cookie) else out.s = th_mask_decode(vp->value.s, vp->value.len, &th_vparam_prefix, 0, &out.len); - if(out.s==NULL) + if(out.s==NULL || out.len<=0) { LM_ERR("cannot decode via %d\n", i); return -1; @@ -949,7 +949,12 @@ int th_add_via_cookie(sip_msg_t *msg, struct via_body *via) if (via->params.s) { viap = via->params.s - via->hdr.s - 1; } else { - viap = via->host.s - via->hdr.s + via->host.len; + if (via->host.s) { + viap = via->host.s - via->hdr.s + via->host.len; + } else { + LM_ERR("no via parameter and no via host, can't insert cookie\n"); + return -1; + } if (via->port!=0) viap += via->port_str.len + 1; /* +1 for ':'*/ }