Browse code

tm: t_serial - safety checks for xavp search result

(cherry picked from commit 67d5aac30d7e44f0d19e41df88fce39f67192483)
(cherry picked from commit e2aa0e44b3e8d283b6be87c8858e384b40fe63db)

Daniel-Constantin Mierla authored on 18/06/2018 07:47:15
Showing 1 changed files
... ...
@@ -635,7 +635,11 @@ int t_next_contacts(struct sip_msg* msg, char* key, char* value)
635 635
 		}
636 636
 
637 637
 		vavp = xavp_get(&flags_name, xavp->val.v.xavp);
638
-		flags = vavp->val.v.i;
638
+		if (vavp != NULL) {
639
+			flags = vavp->val.v.i;
640
+		} else {
641
+			flags = 0;
642
+		}
639 643
 
640 644
 		vavp = xavp_get(&ruid_name, xavp->val.v.xavp);
641 645
 		if (vavp != NULL) {
... ...
@@ -762,8 +766,7 @@ int t_next_contact_flow(struct sip_msg* msg, char* key, char* value)
762 766
 	/* Load Request-URI and branches */
763 767
 	t_get_this_branch_instance(msg, &this_instance);
764 768
 
765
-	if (this_instance.len == 0)
766
-	{
769
+	if (this_instance.len == 0) {
767 770
 		LM_DBG("No instance on this branch\n");
768 771
 		return -2;
769 772
 	}
... ...
@@ -780,13 +783,10 @@ int t_next_contact_flow(struct sip_msg* msg, char* key, char* value)
780 783
 		next_xavp = xavp_get_next(xavp);
781 784
 
782 785
 		vavp = xavp_get(&instance_name, xavp->val.v.xavp);
783
-		if (vavp == NULL)
784
-		{
786
+		if (vavp == NULL) {
785 787
 			/* Does not match this instance */
786 788
 			goto next_xavp;
787
-		}
788
-		else
789
-		{
789
+		} else {
790 790
 			instance = vavp->val.v.s;
791 791
 			if ((instance.len != this_instance.len) ||
792 792
 					(strncmp(instance.s, this_instance.s, instance.len) != 0))
... ...
@@ -795,7 +795,11 @@ int t_next_contact_flow(struct sip_msg* msg, char* key, char* value)
795 795
 		}
796 796
 
797 797
 		vavp = xavp_get(&uri_name, xavp->val.v.xavp);
798
-		uri = vavp->val.v.s;
798
+		if (vavp == NULL) {
799
+			goto next_xavp;
800
+		} else {
801
+			uri = vavp->val.v.s;
802
+		}
799 803
 
800 804
 		vavp = xavp_get(&dst_uri_name, xavp->val.v.xavp);
801 805
 		if (vavp != NULL) {
... ...
@@ -830,13 +834,27 @@ int t_next_contact_flow(struct sip_msg* msg, char* key, char* value)
830 834
 		}
831 835
 
832 836
 		vavp = xavp_get(&flags_name, xavp->val.v.xavp);
833
-		flags = vavp->val.v.i;
837
+		if (vavp != NULL) {
838
+			flags = vavp->val.v.i;
839
+		} else {
840
+			flags = 0;
841
+		}
834 842
 
835 843
 		vavp = xavp_get(&ruid_name, xavp->val.v.xavp);
836
-		ruid = vavp->val.v.s;
844
+		if (vavp != NULL) {
845
+			ruid = vavp->val.v.s;
846
+		} else {
847
+			ruid.s = "";
848
+			ruid.len = 0;
849
+		}
837 850
 
838 851
 		vavp = xavp_get(&ua_name, xavp->val.v.xavp);
839
-		location_ua = vavp->val.v.s;
852
+		if (vavp != NULL) {
853
+			location_ua = vavp->val.v.s;
854
+		} else {
855
+			location_ua.s = "";
856
+			location_ua.len = 0;
857
+		}
840 858
 
841 859
 		LM_DBG("Appending branch uri-'%.*s' dst-'%.*s' path-'%.*s'"
842 860
 				" inst-'%.*s' ruid-'%.*s' location_ua-'%.*s'\n",