kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2026-07-22 14:34:09 -07:00
Code Issues Packages Projects Releases Wiki Activity

pjsip_message_filter: Use pj_strdup instead of pj_strassign to save local address.

Browse Source 
The filter_on_tx_message() function was using pj_strassign() to save the pointer
of the pjproject transport local address to a local pj_str_t variable.  That
variable was ultimately used to set the Contact header's uri->host and the SDP
connection attribute's address again using pj_strassign.  pj_strassign() doesn't
copy the actual value of the pj_str_t however, it just copies the pointer so
if a connection-oriented transport is disconnected before the 200 OK with the
SDP is sent, those pointers will be invalid which can cause use-after-free
issues. To prevent this, filter_on_tx_message() now uses pj_strdup with the
tdata->pool as the backing store to save the local IP address to the local
variable.  pj_strassign() can then be used safely later on since the tdata
will be available for the life of the transaction.

Resolves: #GHSA-g8q2-p36q-94f6
This commit is contained in:
George Joseph
2026-06-10 17:07:07 -06:00
committed by George Joseph
parent d7b804749e
commit a3ec6ffc31
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
res/res_pjsip/pjsip_message_filter.c
+2 -2
View File
@@ -277,11 +277,11 @@ static pj_status_t filter_on_tx_message(pjsip_tx_data *tdata)
/* If the chosen transport is not bound to any we can't use the source address as it won't get back to us */
if (!is_bound_any(tdata->tp_info.transport)) {
pj_strassign(&prm.ret_addr, &tdata->tp_info.transport->local_name.host);
pj_strdup(tdata->pool, &prm.ret_addr, &tdata->tp_info.transport->local_name.host);
}
} else {
/* The transport chosen will deliver this but ensure it is updated with the right information */
pj_strassign(&prm.ret_addr, &tdata->tp_info.transport->local_name.host);
pj_strdup(tdata->pool, &prm.ret_addr, &tdata->tp_info.transport->local_name.host);
}
/* If the message needs to be updated with new address do so */