net/asterisk-16.x/patches/210-AST-2021-001-16.diff

   1 From 757b7f8d7cfee4f541e8d7586e2408556a74201d Mon Sep 17 00:00:00 2001
   2 From: Ivan Poddubnyi <ivan.poddubny@gmail.com>
   3 Date: Mon, 28 Dec 2020 13:43:23 +0100
   4 Subject: [PATCH] res_pjsip_diversion: Fix adding more than one histinfo to
   5  Supported
   6
   7 New responses sent within a PJSIP sessions are based on those that were
   8 sent before. Therefore, adding/modifying a header once causes it to be
   9 sent on all responses that follow.
  10
  11 Sending 181 Call Is Being Forwarded many times first adds "histinfo"
  12 duplicated more and more, and eventually overflows past the array
  13 boundary.
  14
  15 This commit adds a check preventing adding "histinfo" more than once,
  16 and skipping it if there is no more space in the header.
  17
  18 Similar overflow situations can also occur in res_pjsip_path and
  19 res_pjsip_outbound_registration so those were also modified to
  20 check the bounds and suppress duplicate Supported values.
  21
  22 ASTERISK-29227
  23 Reported by: Ivan Poddubny
  24
  25 Change-Id: Id43704a1f1a0293e35cc7f844026f0b04f2ac322
  26 ---
  27  res/res_pjsip_diversion.c             | 14 ++++++++++++++
  28  res/res_pjsip_outbound_registration.c | 12 ++++++++++++
  29  res/res_pjsip_path.c                  | 12 ++++++++++++
  30  3 files changed, 38 insertions(+)
  31
  32 --- a/res/res_pjsip_outbound_registration.c
  33 +++ b/res/res_pjsip_outbound_registration.c
  34 @@ -580,6 +580,7 @@ static int handle_client_registration(vo
  35
  36         if (client_state->support_path) {
  37                 pjsip_supported_hdr *hdr;
  38 +               int i;
  39
  40                 hdr = pjsip_msg_find_hdr(tdata->msg, PJSIP_H_SUPPORTED, NULL);
  41                 if (!hdr) {
  42 @@ -593,6 +594,17 @@ static int handle_client_registration(vo
  43                         pjsip_msg_add_hdr(tdata->msg, (pjsip_hdr *)hdr);
  44                 }
  45
  46 +               /* Don't add the value if it's already there */
  47 +               for (i = 0; i < hdr->count; ++i) {
  48 +                       if (pj_stricmp(&hdr->values[i], &PATH_NAME) == 0) {
  49 +                               return 1;
  50 +                       }
  51 +               }
  52 +
  53 +               if (hdr->count >= PJSIP_GENERIC_ARRAY_MAX_COUNT) {
  54 +                       return 0;
  55 +               }
  56 +
  57                 /* add on to the existing Supported header */
  58                 pj_strassign(&hdr->values[hdr->count++], &PATH_NAME);
  59         }
  60 --- a/res/res_pjsip_path.c
  61 +++ b/res/res_pjsip_path.c
  62 @@ -122,6 +122,7 @@ static int path_get_string(pj_pool_t *po
  63  static int add_supported(pjsip_tx_data *tdata)
  64  {
  65         pjsip_supported_hdr *hdr;
  66 +       int i;
  67
  68         hdr = pjsip_msg_find_hdr(tdata->msg, PJSIP_H_SUPPORTED, NULL);
  69         if (!hdr) {
  70 @@ -134,6 +135,17 @@ static int add_supported(pjsip_tx_data *
  71                 pjsip_msg_add_hdr(tdata->msg, (pjsip_hdr *)hdr);
  72         }
  73
  74 +       /* Don't add the value if it's already there */
  75 +       for (i = 0; i < hdr->count; ++i) {
  76 +               if (pj_stricmp(&hdr->values[i], &PATH_SUPPORTED_NAME) == 0) {
  77 +                       return 0;
  78 +               }
  79 +       }
  80 +
  81 +       if (hdr->count >= PJSIP_GENERIC_ARRAY_MAX_COUNT) {
  82 +               return -1;
  83 +       }
  84 +
  85         /* add on to the existing Supported header */
  86         pj_strassign(&hdr->values[hdr->count++], &PATH_SUPPORTED_NAME);
  87