From 64955aed67e90d83cebb3bdf5ee43b7e17322b93 Mon Sep 17 00:00:00 2001
From: Richard Fuchs <rfuchs@sipwise.com>
Date: Fri, 13 Sep 2019 10:50:38 -0400
Subject: [PATCH] TT#66752 avoid presence_dfks core dumps

dfks_subs_handler does not set default values for XML elements extracted
from the body and ends up doing a strlen(NULL) if the elements are
missing.

Change-Id: I520f9f0a45c35bfb134fac5a0aa275ee3d2613f3
(cherry picked from commit 9d76dcbce97dd41e7c10fe8b98456153a4e570ee)
---
 debian/patches/series                         |  1 +
 .../presence_dfks_null_ptr_fixes.patch        | 81 +++++++++++++++++++
 2 files changed, 82 insertions(+)
 create mode 100644 debian/patches/sipwise/presence_dfks_null_ptr_fixes.patch

diff --git a/debian/patches/series b/debian/patches/series
index 76efd3d2f..4ccf69c45 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -52,3 +52,4 @@ sipwise/db_redis_master_keys.patch
 sipwise/db_redis_master_sets.patch
 sipwise/db_redis_fixes.patch
 sipwise/sca-fix-memleaks.patch
+sipwise/presence_dfks_null_ptr_fixes.patch
diff --git a/debian/patches/sipwise/presence_dfks_null_ptr_fixes.patch b/debian/patches/sipwise/presence_dfks_null_ptr_fixes.patch
new file mode 100644
index 000000000..4ec7af098
--- /dev/null
+++ b/debian/patches/sipwise/presence_dfks_null_ptr_fixes.patch
@@ -0,0 +1,81 @@
+--- a/src/modules/presence_dfks/add_events.c
++++ b/src/modules/presence_dfks/add_events.c
+@@ -156,14 +156,13 @@
+ 	if(top_elem != NULL) {
+ 		LM_DBG(" got SetDoNotDisturb\n");
+ 		param = libxml_api.xmlNodeGetNodeByName(top_elem, "doNotDisturbOn", NULL);
+-		if(param!= NULL) {
++		if(param!= NULL)
+ 			dndact= (char*)xmlNodeGetContent(param);
+-			if(dndact== NULL)  {
+-				LM_ERR("while extracting value from 'doNotDisturbOn' in 'SetDoNotDisturb'\n");
+-				goto error;
+-			}
+-			LM_DBG("got 'doNotDisturbOn'=%s in 'SetDoNotDisturb'\n",dndact);
++		if(dndact== NULL)  {
++			LM_ERR("while extracting value from 'doNotDisturbOn' in 'SetDoNotDisturb'\n");
++			goto error;
+ 		}
++		LM_DBG("got 'doNotDisturbOn'=%s in 'SetDoNotDisturb'\n",dndact);
+ 		param = NULL;
+ 		param = libxml_api.xmlNodeGetNodeByName(top_elem, "device", NULL);
+ 		if(param!= NULL) {
+@@ -215,32 +214,29 @@
+ 	if(top_elem != NULL) {
+ 		LM_DBG(" got SetForwarding\n");
+ 		param = libxml_api.xmlNodeGetNodeByName(top_elem, "forwardDN", NULL);
+-		if(param!= NULL) {
++		if(param!= NULL)
+ 			fwdDN= (char*)xmlNodeGetContent(param);
+-			if(fwdDN== NULL) {
+-				LM_ERR("while extracting value from 'forwardDN' in 'SetForwarding'\n");
+-				goto error;
+-			}
+-			LM_DBG("got 'forwardDN'=%s in 'SetForwarding'\n",fwdDN);
++		if(fwdDN== NULL) {
++			LM_ERR("while extracting value from 'forwardDN' in 'SetForwarding'\n");
++			goto error;
+ 		}
++		LM_DBG("got 'forwardDN'=%s in 'SetForwarding'\n",fwdDN);
+ 		param = libxml_api.xmlNodeGetNodeByName(top_elem, "forwardingType", NULL);
+-		if(param!= NULL) {
++		if(param!= NULL)
+ 			fwdtype= (char*)xmlNodeGetContent(param);
+-			if(fwdtype== NULL) {
+-				LM_ERR("while extracting value from 'forwardingType' in 'SetForwarding'\n");
+-				goto error;
+-			}
+-			LM_DBG("got 'forwardingType'=%s in 'SetForwarding'\n",fwdtype);
++		if(fwdtype== NULL) {
++			LM_ERR("while extracting value from 'forwardingType' in 'SetForwarding'\n");
++			goto error;
+ 		}
++		LM_DBG("got 'forwardingType'=%s in 'SetForwarding'\n",fwdtype);
+ 		param = libxml_api.xmlNodeGetNodeByName(top_elem, "activateForward", NULL);
+-		if(param!= NULL) {
++		if(param!= NULL)
+ 			fwdact= (char*)xmlNodeGetContent(param);
+-			if(fwdact== NULL) {
+-				LM_ERR("while extracting value from 'activateForward' in 'SetForwarding'\n");
+-				goto error;
+-			}
+-			LM_DBG("got 'activateForward'=%s in 'SetForwarding'\n",fwdact);
++		if(fwdact== NULL) {
++			LM_ERR("while extracting value from 'activateForward' in 'SetForwarding'\n");
++			goto error;
+ 		}
++		LM_DBG("got 'activateForward'=%s in 'SetForwarding'\n",fwdact);
+ 		param = libxml_api.xmlNodeGetNodeByName(top_elem, "device", NULL);
+ 		if(param!= NULL) {
+ 			device= (char*)xmlNodeGetContent(param);
+@@ -250,7 +246,9 @@
+ 			}
+ 			LM_DBG("got 'device'=%s in 'SetDoNotDisturb'\n",device);
+ 		}
+-		body.len=fwd_xml.len -8 + strlen(device) + strlen(device) +strlen(fwdtype) + strlen(fwdact) +strlen(fwdDN);
++		else
++			device=unk_dev.s;
++		body.len=fwd_xml.len -8 + strlen(device) +strlen(fwdtype) + strlen(fwdact) +strlen(fwdDN);
+ 		body.s=pkg_malloc(body.len+1);
+ 		if(body.s== NULL)  {
+ 			LM_ERR("while extracting allocating body for publish in 'SetForwarding'\n");