diff options
| author | Michael Mann <mmann78@netscape.net> | 2013-02-14 03:30:32 +0000 |
|---|---|---|
| committer | Michael Mann <mmann78@netscape.net> | 2013-02-14 03:30:32 +0000 |
| commit | ad92b749e8b51da0c5ebb73d7c002386a333aaa5 (patch) | |
| tree | d2a07971858e71308e966f1ba6ac41b90095b7b5 /epan/dissectors/packet-sdp.c | |
| parent | 7410bf54a11dcdb194e6ba5d883df49d867e6eab (diff) | |
Fix crash with SDP setup mechanism, bug 8323 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8323)
The issue was that hash tables were being accessed after they were freed from a "rejected answer".
The code was also too generous in considering many SIP status codes as "rejected answers", so now less SIP status codes are treated as "rejected answers" and are ignored by the transport API.
svn path=/trunk/; revision=47652
Diffstat (limited to 'epan/dissectors/packet-sdp.c')
| -rw-r--r-- | epan/dissectors/packet-sdp.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/epan/dissectors/packet-sdp.c b/epan/dissectors/packet-sdp.c index 5e206d29f9..6c1c2f8c5e 100644 --- a/epan/dissectors/packet-sdp.c +++ b/epan/dissectors/packet-sdp.c @@ -1740,6 +1740,12 @@ setup_sdp_transport(tvbuff_t *tvb, packet_info *pinfo, enum sdp_exchange_type ex if (exchange_type != SDP_EXCHANGE_OFFER) se_tree_insert32(sdp_transport_rsps, pinfo->fd->num, (void *)transport_info); + /* Offer has already been rejected and hash tables freed, so + * don't try to add to it + * XXX - Need to support "modified offers" */ + if (transport_info->sdp_status == SDP_EXCHANGE_ANSWER_REJECT) + return; + if (transport_info->media_count > 0) start_transport_info_count = transport_info->media_count; @@ -2150,7 +2156,7 @@ dissect_sdp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) if (transport_info == &local_transport_info) convert_disposable_media(transport_info, &media_info, 0); - for (n = 0; n < transport_info->media_count; n++) + for (n = 0; n < local_transport_info.media_count; n++) { set_rtp = FALSE; |