@@ -27,6 +27,7 @@ char* parse_first_line(char* buffer, unsigned int len, struct msg_start * fl)

 	char* third;

 	char* nl;

 	int offset;

+	char* end;

 	/* grammar:

 		request  =  method SP uri SP version CRLF

@@ -35,9 +36,10 @@ char* parse_first_line(char* buffer, unsigned int len, struct msg_start * fl)

 	*/

+	end=buffer+len;

 	/* see if it's a reply (status) */

 	tmp=eat_token(buffer, len);

-	if (tmp==buffer){

+	if ((tmp==buffer)||(tmp>=end)){

 		DPrint("ERROR: empty  or bad first line\n");

 		goto error1;

 	}

@@ -52,7 +54,7 @@ char* parse_first_line(char* buffer, unsigned int len, struct msg_start * fl)

 	offset=tmp-buffer;

 	second=eat_space(tmp, len-offset);

 	offset+=second-tmp;

-	if (second==tmp){

+	if ((second==tmp)||(tmp>=end)){

 		goto error;

 	}

 	*tmp=0; /* mark the end of the token */

@@ -60,24 +62,41 @@ char* parse_first_line(char* buffer, unsigned int len, struct msg_start * fl)

 	/* next element */

 	tmp=eat_token(second, len-offset);

+	if (tmp>=end){

+		goto error;

+	}

 	offset+=tmp-second;

 	third=eat_space(tmp, len-offset);

 	offset+=third-tmp;

-	if(third==tmp){

+	if ((third==tmp)||(tmp>=end)){

 		goto error;

 	}

 	*tmp=0; /* mark the end of the token */

 	fl->u.request.uri=second;

-	/*  last part */

-	tmp=eat_token(third,len-offset);

-	offset+=tmp-third;

-	if (tmp==third){

-		goto error;

+	/*  last part: for a request it must be the version, for a reply

+	 *  it can contain almost anything, including spaces, so we don't care

+	 *  about it*/

+	if (fl->type==SIP_REQUEST){

+		tmp=eat_token(third,len-offset);

+		offset+=tmp-third;

+		if ((tmp==third)||(tmp>=end)){

+			goto error;

+		}

+		if (! is_empty(tmp, len-offset)){

+			goto error;

+		}

+	}else{

+		tmp=eat_token2(third,len-offset,'\r'); /* find end of line 

+												  ('\n' or '\r') */

+		if (tmp>=end){ /* no crlf in packet => invalid */

+			goto error;

+		}

+		offset+=tmp-third;

 	}

-	if (! is_empty(tmp, len-offset)){		

+	nl=eat_line(tmp,len-offset);

+	if (nl>=end){ /* no crlf in packet or only 1 line > invalid */

 		goto error;

 	}

-	nl=eat_line(tmp,len-offset);

 	*tmp=0;

 	fl->u.request.version=third;

@@ -238,9 +257,9 @@ char* parse_via_body(char* buffer,unsigned int len, struct via_body * vb)

 		switch (*tmp){

 			case ' ':

 				*tmp=0;

+				tmp++;

 				/*the rest is comment? */

-				if (tmp+1-buffer<len){

-					tmp++;

+				if (tmp-buffer<len){

 					comment=tmp;

 					/* eat the comment */

 					for(;((tmp-buffer)<len)&&

@@ -258,8 +277,8 @@ char* parse_via_body(char* buffer,unsigned int len, struct via_body * vb)

 			case ';':

 				*tmp=0;

-				if (tmp+1-buffer>=len) goto error;

 				tmp++;

+				if (tmp-buffer>=len) goto error;

 				params=tmp;

 				/* eat till end, first space  or ',' */

 				for(;((tmp-buffer)<len)&&

@@ -283,10 +302,10 @@ char* parse_via_body(char* buffer,unsigned int len, struct via_body * vb)

 			case ',':

 				*tmp=0;

-				if (tmp+1-buffer<len){

+				tmp++;

+				if (tmp-buffer<len){

 					/* eat space and ',' */

-					for(tmp=tmp+1; 

-						((tmp-buffer)<len)&&

+					for(;((tmp-buffer)<len)&&

 						(*tmp==' '|| *tmp==',');

 					   tmp++);

 				}

@@ -425,7 +444,7 @@ skip:

 	if (second_via) {

 		tmp=parse_via_body(second_via, strlen(second_via), &vb2);

 		if (vb2.error!=VIA_PARSE_OK){

-			DPrint("ERROR: parsing via body: %s\n", second_via);

+			DPrint("ERROR: parsing via2 body: %s\n", second_via);

 			goto error;

 		}

 		vb2.size=tmp-second_via; 

@@ -7,7 +7,7 @@

 #include  "parser_f.h"

-/* returns pointer to next line or end of buffer */

+/* returns pointer to next line or after the end of buffer */

 char* eat_line(char* buffer, unsigned int len)

 {

 	char* nl;

@@ -24,7 +24,7 @@ char* eat_line(char* buffer, unsigned int len)

-/* returns pointer to first non  white char or to the end  of the buffer */

+/* returns pointer to first non  white char or after the end  of the buffer */

 char* eat_space(char* buffer, unsigned int len)

 {

 	char* p;

@@ -21,7 +21,7 @@ int receive_msg(char* buf, unsigned int len)

 	orig=(char*) malloc(len);

 	if (orig==0){

 		DPrint("ERROR: memory allocation failure\n");

-		goto error;

+		goto error1;

 	}

 	memcpy(orig, buf, len);

@@ -74,7 +74,8 @@ skip:

 	free(orig);

 	return 0;

 error:

+	free(orig);

+error1:

 	return -1;

-

 }

@@ -4,6 +4,7 @@

 #  method_re   sip_uri_re      dest_host

 # (warning: re cannot contain space)

+.*			.*				   fox.iptel.org

 ^R.*        ^sip:.*@dorian.*   ekina.fokus.gmd.de        

 ^INVITE     .*                 ape:5061             # my laptop

 .           .                  192.168.46.55