From 34e6b76355c22c9dc32c7e6aec2b43ada5622b7d Mon Sep 17 00:00:00 2001 From: Donat Zenichev Date: Tue, 29 Jul 2025 15:52:09 +0200 Subject: [PATCH] MT#59962 AmOfferAnswer: no need to parse CSTA body Not even used in `AmOfferAnswer::onReplyIn()`. Fixes: *** CID 583407: (FORWARD_NULL) /core/AmOfferAnswer.cpp: 217 in AmOfferAnswer::onReplyIn(const AmSipReply &)() 211 { 212 /* hack to handle 2xx with different tag than was in 183: accept the 213 * new SDP though we should accept the first one we received (without 214 * fork) */ 215 ILOG_DLG(L_DBG, "overwriting SDP remembered within the same transaction\n"); 216 >>> CID 583407: (FORWARD_NULL) >>> Passing null pointer "sdp_body" to "getPayload", which dereferences it. 217 if (sdp_remote.parse((const char*)sdp_body->getPayload())){ 218 err_code = 400; 219 err_txt = "session description parsing failed"; 220 } else if(sdp_remote.media.empty()){ 221 err_code = 400; 222 err_txt = "no media line found in SDP message"; /core/AmOfferAnswer.cpp: 243 in AmOfferAnswer::onReplyIn(const AmSipReply &)() 237 remote_port_seen = remote.port; 238 } 239 240 } else { 241 bool is_reliable = reply.code >= 200 || key_in_list(getHeader(reply.hdrs, SIP_HDR_REQUIRE), SIP_EXT_100REL); 242 saveState(); >>> CID 583407: (FORWARD_NULL) >>> Passing null pointer "sdp_body" to "onRxSdp", which dereferences it. 243 err_code = onRxSdp(reply.cseq,reply.to_tag,is_reliable, *sdp_body,&err_txt); 244 checkStateChange(); 245 } 246 } 247 } 248 Change-Id: I5298acf7ac54e3335a88cd3a18d1fea3d5436dda --- core/AmOfferAnswer.cpp | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/core/AmOfferAnswer.cpp b/core/AmOfferAnswer.cpp index 8e0711f1..1da1c658 100644 --- a/core/AmOfferAnswer.cpp +++ b/core/AmOfferAnswer.cpp @@ -198,9 +198,7 @@ int AmOfferAnswer::onReplyIn(const AmSipReply& reply) !reply.body.empty() ) { const AmMimeBody* sdp_body = reply.body.hasContentType(SIP_APPLICATION_SDP); - const AmMimeBody* csta_body = reply.body.hasContentType(SIP_APPLICATION_CSTA_XML); - - if (sdp_body || csta_body) { + if (sdp_body) { if ((reply.cseq_method == SIP_METH_INVITE) && ((state == OA_Completed)