瀏覽代碼

core: Added null pointer check to parser/msg_parser.c:get_hdr_field().

Encountered crash bug in which 'buf' pointer passed to get_hdr_field()
was null.  There is no null check, so attempts to dereference it lead to
a crash:

Core was generated by `/usr/local/sbin/kamailio -P /var/run/kamailio.pid -m 1024 -u root -g root -f /r'.
Program terminated with signal 11, Segmentation fault.
    at parser/msg_parser.c:102
102		if ((*buf)=='\n' || (*buf)=='\r'){

Fixed by adding a check for buf == NULL to top of function.
Alex Balashov 13 年之前
父節點
當前提交
9fc34aad63
共有 1 個文件被更改,包括 5 次插入0 次删除
  1. 5 0
      parser/msg_parser.c

+ 5 - 0
parser/msg_parser.c

@@ -96,6 +96,11 @@ char* get_hdr_field(char* const buf, char* const end, struct hdr_field* const hd
 	int integer, err;
 	unsigned uval;
 
+	if(!buf) {
+		DBG("null buffer pointer\n");
+		goto error;
+	}
+
 	if ((*buf)=='\n' || (*buf)=='\r'){
 		/* double crlf or lflf or crcr */
 		DBG("found end of header\n");