Module: sip-router Branch: luismartingil/msrp_crash Commit: 31469a0541874b1b0a5dda89aec0eed4ad94d97e URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=31469a0… Author: Luis Martin Gil <martingil.luis(a)gmail.com> Committer: Luis Martin Gil <martingil.luis(a)gmail.com> Date: Thu Apr 17 12:49:52 2014 +0000 msrp: improved parser - Added more logic to the parser: Not allowing multiple To-Paths or From-Paths --- modules/msrp/msrp_parser.c | 26 ++++++++++++++++++-------- 1 files changed, 18 insertions(+), 8 deletions(-) diff --git a/modules/msrp/msrp_parser.c b/modules/msrp/msrp_parser.c index b23c5a1..fc81798 100644 --- a/modules/msrp/msrp_parser.c +++ b/modules/msrp/msrp_parser.c @@ -293,24 +293,34 @@ int msrp_parse_headers(msrp_frame_t *mf) last = hdr; } msrp_hdr_set_type(hdr); - + + /* Checking for well-formed MSRP rfc4975 messages */ if (hdr->htype == MSRP_HDR_TO_PATH) { - tpath = 1; - if (fpath || any) { + if (tpath) { + LM_ERR("broken msrp frame message, Multiple To-Path not allowed.\n"); + return -1; + } else if (fpath || any) { LM_ERR("broken msrp frame message, To-Path must be the first header.\n"); - return -1; + return -1; + } else { + tpath = 1; } } else if (hdr->htype == MSRP_HDR_FROM_PATH) { - fpath = 1; - if (!tpath || any) { - LM_ERR("broken msrp frame message, From-Path must be the second header.\n"); + if (fpath) { + LM_ERR("broken msrp frame message, Multiple From-Path not allowed.\n"); return -1; + } else if (!tpath || any) { + LM_ERR("broken msrp frame message, From-Path must be after To-Path.\n"); + return -1; + } else { + fpath = 1; } } else { - any = 1; if (!tpath || !fpath) { LM_ERR("broken msrp frame message, To-Path and From-Path must be defined before any header.\n"); return -1; + } else { + any = 1; } }