Browse code

rtpengine: safety check for tm uas.request field

Daniel-Constantin Mierla authored on 10/09/2018 06:19:02
Showing 1 changed files
... ...
@@ -3310,6 +3310,7 @@ rtpengine_manage(struct sip_msg *msg, const char *flags)
3310 3310
 {
3311 3311
 	int method;
3312 3312
 	int nosdp;
3313
+	tm_cell_t *t = NULL;
3313 3314
 
3314 3315
 	if (msg->cseq==NULL && ((parse_headers(msg, HDR_CSEQ_F, 0)==-1) ||
3315 3316
 	   (msg->cseq==NULL)))
... ...
@@ -3339,9 +3340,12 @@ rtpengine_manage(struct sip_msg *msg, const char *flags)
3339 3340
 			return rtpengine_offer_answer(msg, flags, OP_OFFER, 0);
3340 3341
 		if(method==METHOD_INVITE && nosdp==0) {
3341 3342
 			msg->msg_flags |= FL_SDP_BODY;
3342
-			if(tmb.t_gett!=NULL && tmb.t_gett()!=NULL
3343
-					&& tmb.t_gett()!=T_UNDEFINED)
3344
-				tmb.t_gett()->uas.request->msg_flags |= FL_SDP_BODY;
3343
+			if(tmb.t_gett!=NULL) {
3344
+				t = tmb.t_gett();
3345
+				if(t!=NULL && t!=T_UNDEFINED && t->uas.request!=NULL) {
3346
+					t->uas.request->msg_flags |= FL_SDP_BODY;
3347
+				}
3348
+			}
3345 3349
 			if(route_type==FAILURE_ROUTE)
3346 3350
 				return rtpengine_delete(msg, flags);
3347 3351
 			return rtpengine_offer_answer(msg, flags, OP_OFFER, 0);