From dc819e881e3b31ebafcbe1f23fd707850b4b50ba Mon Sep 17 00:00:00 2001
From: Michiel van Baak <michiel@vanbaak.info>
Date: Sun, 3 Aug 2008 00:00:06 +0000
Subject: [PATCH] Dont coredump on register of non-configured devices
(closes issue #13224)
Reported by: mvanbaak
Patches:
noncon.diff uploaded by wedhorn (license 30) with whitespace fixes by me
Tested by: wedhorn, mvanbaak
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@135371 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---
channels/chan_skinny.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)
diff --git a/channels/chan_skinny.c b/channels/chan_skinny.c
index 5afeabb723..e0b9de1edc 100644
--- a/channels/chan_skinny.c
+++ b/channels/chan_skinny.c
@@ -4179,8 +4179,28 @@ static int handle_register_message(struct skinny_req *req, struct skinnysession
return -1;
snprintf(req->data.regrej.errMsg, sizeof(req->data.regrej.errMsg), "No Authority: %s", name);
- d->session = s;
- transmit_response(d, req);
+
+ /* transmit_respons in line as we don't have a valid d */
+ ast_mutex_lock(&s->lock);
+
+ if (letohl(req->len > SKINNY_MAX_PACKET) || letohl(req->len < 0)) {
+ ast_log(LOG_WARNING, "transmit_response: the length of the request is out of bounds\n");
+ ast_mutex_unlock(&s->lock);
+ return -1;
+ }
+
+ memset(s->outbuf, 0, sizeof(s->outbuf));
+ memcpy(s->outbuf, req, skinny_header_size);
+ memcpy(s->outbuf+skinny_header_size, &req->data, letohl(req->len));
+
+ res = write(s->fd, s->outbuf, letohl(req->len)+8);
+
+ if (res != letohl(req->len)+8) {
+ ast_log(LOG_WARNING, "Transmit: write only sent %d out of %d bytes: %s\n", res, letohl(req->len)+8, strerror(errno));
+ }
+
+ ast_mutex_unlock(&s->lock);
+
return 0;
}
ast_verb(3, "Device '%s' successfully registered\n", name);
--
GitLab