浏览代码

jsonrpc-s: safety check for str value of jsonrpc and method fileds

- reported by Alex Balashov
Daniel-Constantin Mierla 10 年之前
父节点
当前提交
29fe7a813b
共有 1 个文件被更改,包括 4 次插入4 次删除
  1. 4 4
      modules/jsonrpc-s/jsonrpc-s_mod.c

+ 4 - 4
modules/jsonrpc-s/jsonrpc-s_mod.c

@@ -935,8 +935,8 @@ static int jsonrpc_dispatch(sip_msg_t* msg, char* s1, char* s2)
 
 	/* sanity checks on jsonrpc request */
 	nj = srjson_GetObjectItem(ctx->jreq, ctx->jreq->root, "jsonrpc");
-	if(nj==NULL) {
-		LM_ERR("missing jsonrpc field in request\n");
+	if(nj==NULL || nj->valuestring==NULL) {
+		LM_ERR("missing or invalid jsonrpc field in request\n");
 		goto send_reply;
 	}
 	val.s = nj->valuestring;
@@ -947,8 +947,8 @@ static int jsonrpc_dispatch(sip_msg_t* msg, char* s1, char* s2)
 	}
 	/* run jsonrpc command */
 	nj = srjson_GetObjectItem(ctx->jreq, ctx->jreq->root, "method");
-	if(nj==NULL) {
-		LM_ERR("missing jsonrpc method field in request\n");
+	if(nj==NULL || nj->valuestring==NULL) {
+		LM_ERR("missing or invalid jsonrpc method field in request\n");
 		goto send_reply;
 	}
 	val.s = nj->valuestring;