diff options
author | Neels Hofmeyr <neels@hofmeyr.de> | 2021-06-01 03:33:59 +0200 |
---|---|---|
committer | Neels Hofmeyr <neels@hofmeyr.de> | 2021-06-01 03:35:53 +0200 |
commit | 97c7916892da9877a37514f66e3f8c15012f2ef1 (patch) | |
tree | 9e09c52b223299c119edb4af805243cabcd81e73 | |
parent | d9e57e5f08d54279915b2f3c74ef3f0dea60ee5d (diff) |
fix use-after-free in SIP re-INVITE
Copy the m_mode before freeing the parser.
Address sanitizer aborted with:
20210601033017695 DSIP INFO re-INVITE for call 854A5CDA8037073 (sip.c:192)
=================================================================
==8583==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000003250 at pc 0x55c3b4624dc5 bp 0x7ffe8a4464d0 sp 0x7ffe8a4464c8
READ of size 8 at 0x612000003250 thread T0
#0 0x55c3b4624dc4 in sdp_get_sdp_mode ../../../src/osmo-sip-connector/src/sdp.c:72
#1 0x55c3b462be9e in sip_handle_reinvite ../../../src/osmo-sip-connector/src/sip.c:202
#2 0x55c3b462d676 in nua_callback ../../../src/osmo-sip-connector/src/sip.c:397
[...]
Change-Id: I4c48832f01e61e98536de8f164ab5a3caa64f34a
-rw-r--r-- | src/sdp.c | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -68,8 +68,8 @@ bool sdp_get_sdp_mode(const sip_t *sip, sdp_mode_t *mode) { return sdp_sendrecv; } - sdp_parser_free(parser); *mode = sdp->sdp_media->m_mode; + sdp_parser_free(parser); return true; } |