tm: fake_req dst_uri and ruri copy fix
authorAndrei Pelinescu-Onciul <andrei@iptel.org>
Wed, 17 Feb 2010 19:40:46 +0000 (20:40 +0100)
committerAndrei Pelinescu-Onciul <andrei@iptel.org>
Wed, 17 Feb 2010 19:40:46 +0000 (20:40 +0100)
If the uris have 0 len but no 0 value (possible at least for a
manually set dst_uri), set the corresponding fake_req uri to 0,
thus avoiding a potentially disastrous free in free_faked_req().

Should close FS#37.

modules/tm/t_reply.c

index 02b03e5..ff89dd4 100644 (file)
@@ -772,6 +772,9 @@ int fake_req(struct sip_msg *faked_req,
                memcpy( faked_req->dst_uri.s, shmem_msg->dst_uri.s,
                        faked_req->dst_uri.len);
                faked_req->dst_uri.s[faked_req->dst_uri.len]=0;
+       }else{
+               /* in case len==0, but shmem_msg->dst_uri.s!=0 (extra safety) */
+               faked_req->dst_uri.s = 0;
        }
        /* new_uri can change -- make a private copy */
        if (shmem_msg->new_uri.s!=0 && shmem_msg->new_uri.len!=0) {
@@ -784,6 +787,9 @@ int fake_req(struct sip_msg *faked_req,
                memcpy( faked_req->new_uri.s, shmem_msg->new_uri.s,
                        faked_req->new_uri.len);
                faked_req->new_uri.s[faked_req->new_uri.len]=0;
+       }else{
+               /* in case len==0, but shmem_msg->new_uri.s!=0  (extra safety)*/
+               faked_req->new_uri.s = 0;
        }
        if(uac) setbflagsval(0, uac->branch_flags);
        else setbflagsval(0, 0);