From 65cb4eaeb0ed0f0f47d863b60d9e8e5641e06bd9 Mon Sep 17 00:00:00 2001 From: Richard Fuchs Date: Tue, 15 Jul 2025 10:56:41 -0400 Subject: [PATCH] MT#62181 change to_tag to std::string For memory safety. No functional change. Change-Id: I408d25aa7ba65e9fef8bb287003196e47f1025ed --- core/SipCtrlInterface.cpp | 7 ++----- core/sip/sip_trans.cpp | 7 ++----- core/sip/sip_trans.h | 2 +- core/sip/trans_layer.cpp | 32 ++++++++++++++------------------ core/sip/trans_layer.h | 2 +- core/sip/trans_table.cpp | 15 +++------------ 6 files changed, 23 insertions(+), 42 deletions(-) diff --git a/core/SipCtrlInterface.cpp b/core/SipCtrlInterface.cpp index af90311c..2d43c780 100644 --- a/core/SipCtrlInterface.cpp +++ b/core/SipCtrlInterface.cpp @@ -412,7 +412,7 @@ int SipCtrlInterface::send(const AmSipReply &rep, const string& dialog_id, return trans_layer::instance()->send_reply(&msg,(trans_ticket*)&rep.tt, dialog_id, - stl2cstr(rep.to_tag),logger); + rep.to_tag, logger); } @@ -787,10 +787,7 @@ void SipCtrlInterface::handle_reply_timeout(AmSipTimeoutEvent::EvType evt, return; } - string dlg_id = c2stlstr(tr->to_tag); - if (!tr->dialog_id.empty()) { - dlg_id = tr->dialog_id; - } + const string& dlg_id = tr->dialog_id.empty() ? tr->to_tag : tr->dialog_id; if(!AmEventDispatcher::instance()->post(dlg_id, tmo_evt)){ DBG("Could not post timeout event (sess. id: %s)\n", dlg_id.c_str()); diff --git a/core/sip/sip_trans.cpp b/core/sip/sip_trans.cpp index 7f5b2a6e..1ddb2ba1 100644 --- a/core/sip/sip_trans.cpp +++ b/core/sip/sip_trans.cpp @@ -90,9 +90,6 @@ sip_trans::~sip_trans() delete msg; delete targets; delete [] retr_buf; - if((type == TT_UAC) && to_tag.s){ - delete [] to_tag.s; - } } /** @@ -275,9 +272,9 @@ const char* sip_trans::state_str() const void sip_trans::dump() const { - DBG("type=%s (0x%x); msg=%p; to_tag=%.*s;" + DBG("type=%s (0x%x); msg=%p; to_tag=%s;" " reply_status=%i; state=%s (%i); retr_buf=%p; timers [%s,%s,%s]\n", - type_str(),type,msg,to_tag.len,to_tag.s, + type_str(), type, msg, to_tag.c_str(), reply_status,state_str(),state,retr_buf, timers[0]==NULL?"none":timer_name(timers[0]->type), timers[1]==NULL?"none":timer_name(timers[1]->type), diff --git a/core/sip/sip_trans.h b/core/sip/sip_trans.h index 0fe5b19c..8823fc7f 100644 --- a/core/sip/sip_trans.h +++ b/core/sip/sip_trans.h @@ -120,7 +120,7 @@ class sip_trans /** To-tag included in reply. (useful for ACK matching) */ - cstring to_tag; + string to_tag; /** reply code of last sent/received reply */ diff --git a/core/sip/trans_layer.cpp b/core/sip/trans_layer.cpp index 861a536f..b96474c2 100644 --- a/core/sip/trans_layer.cpp +++ b/core/sip/trans_layer.cpp @@ -216,7 +216,7 @@ static int patch_contact_transport(sip_header* contact, const cstring& trsp, } int trans_layer::send_reply(sip_msg* msg, const trans_ticket* tt, - const string& dialog_id, const cstring& to_tag, + const string& dialog_id, const string& to_tag, const shared_ptr& logger) { // Ref.: RFC 3261 8.2.6, 12.1.1 @@ -329,17 +329,17 @@ int trans_layer::send_reply(sip_msg* msg, const trans_ticket* tt, case sip_header::H_TO: if (!(*it)->p) break; // ignore if not parsed - if(to_tag.len) { + if (!to_tag.empty()) { if(! ((sip_from_to*)(*it)->p)->tag.len ) { reply_len += 5/* ';tag=' */ - + to_tag.len; + + to_tag.length(); } else { // To-tag present in request... have_to_tag = true; // ... save it: - t->to_tag = ((sip_from_to*)(*it)->p)->tag; + t->to_tag = c2stlstr(((sip_from_to*)(*it)->p)->tag); } } else if(reply_code >= 300) { @@ -484,7 +484,7 @@ int trans_layer::send_reply(sip_msg* msg, const trans_ticket* tt, case sip_header::H_TO: if (!(*it)->p) break; // ignore if not parsed - if(!to_tag.len || have_to_tag){ + if (to_tag.empty() || have_to_tag){ copy_hdr_wr(&c,*it); } else { @@ -500,11 +500,10 @@ int trans_layer::send_reply(sip_msg* msg, const trans_ticket* tt, memcpy(c,";tag=",5); c += 5; - t->to_tag.s = c; - t->to_tag.len = to_tag.len; + t->to_tag = to_tag; - memcpy(c,to_tag.s,to_tag.len); - c += to_tag.len; + memcpy(c, to_tag.c_str(), to_tag.length()); + c += to_tag.length(); *(c++) = CR; *(c++) = LF; @@ -649,8 +648,8 @@ int trans_layer::send_sf_error_reply(const trans_ticket* tt, const sip_msg* req, const cstring& hdrs, const cstring& body) { char to_tag_buf[SL_TOTAG_LEN]; - cstring to_tag(to_tag_buf,SL_TOTAG_LEN); compute_sl_to_tag(to_tag_buf,req); + string to_tag(to_tag_buf, SL_TOTAG_LEN); sip_msg reply; reply.u.reply = new sip_reply(reply_code,reason); @@ -1769,7 +1768,7 @@ int trans_layer::update_uac_reply(trans_bucket* bucket, sip_trans* t, sip_msg* m { assert(msg->type == SIP_REPLY); - cstring to_tag; + string to_tag; int reply_code = msg->u.reply->code; DBG("update_uac_reply(reply code = %i, trans=%p)\n",reply_code, t); @@ -1829,7 +1828,7 @@ int trans_layer::update_uac_reply(trans_bucket* bucket, sip_trans* t, sip_msg* m } } - to_tag = ((sip_from_to*)msg->to->p)->tag; + to_tag = c2stlstr(((sip_from_to*)msg->to->p)->tag); // if((t->msg->u.request->method == sip_request::INVITE) && // (reply_code < 300) && // !to_tag.len){ @@ -1940,18 +1939,15 @@ int trans_layer::update_uac_reply(trans_bucket* bucket, sip_trans* t, sip_msg* m t->reset_timer(STIMER_L, L_TIMER, bucket->get_id()); - if (t->to_tag.len==0 && to_tag.len!=0) { - t->to_tag.s = new char[to_tag.len]; - t->to_tag.len = to_tag.len; - memcpy((void*)t->to_tag.s,to_tag.s,to_tag.len); + if (t->to_tag.empty() && !to_tag.empty()) { + t->to_tag = to_tag; } goto pass_reply; case TS_TERMINATED_200: // subsequent 2xx reply (no ACK sent) - if( (to_tag.len != t->to_tag.len) || - (memcmp(to_tag.s,t->to_tag.s,to_tag.len) != 0) ){ + if (to_tag != t->to_tag) { // TODO: // (this should be implemented in the UA) diff --git a/core/sip/trans_layer.h b/core/sip/trans_layer.h index b8b475b0..d7328cb6 100644 --- a/core/sip/trans_layer.h +++ b/core/sip/trans_layer.h @@ -170,7 +170,7 @@ public: * 'Content-Length' header. */ int send_reply(sip_msg* msg, const trans_ticket* tt, const string& dialog_id, - const cstring& to_tag, + const string& to_tag, const shared_ptr& logger=NULL); /** diff --git a/core/sip/trans_table.cpp b/core/sip/trans_table.cpp index 4c7b3059..0f6e213f 100644 --- a/core/sip/trans_table.cpp +++ b/core/sip/trans_table.cpp @@ -217,10 +217,7 @@ sip_trans* trans_bucket::match_request(sip_msg* msg, unsigned int ttype) if(msg->u.request->method == sip_request::ACK){ // ACKs must include To-tag from previous reply - if(to->tag.len != (*it)->to_tag.len) - continue; - - if(memcmp(to->tag.s,(*it)->to_tag.s,to->tag.len)) + if (c2stlstr(to->tag) != (*it)->to_tag) continue; if((*it)->reply_status < 300){ @@ -340,7 +337,7 @@ sip_trans* trans_bucket::match_200_ack(sip_trans* t, sip_msg* msg) if(msg->callid->value.len != t->msg->callid->value.len) return NULL; - if(to->tag.len != t->to_tag.len) + if(c2stlstr(to->tag) != t->to_tag) return NULL; if(memcmp(from->tag.s,t_from->tag.s,from->tag.len)) @@ -350,9 +347,6 @@ sip_trans* trans_bucket::match_200_ack(sip_trans* t, sip_msg* msg) msg->callid->value.len)) return NULL; - if(memcmp(to->tag.s,t->to_tag.s,to->tag.len)) - return NULL; - return t; } @@ -381,7 +375,7 @@ sip_trans* trans_bucket::match_1xx_prack(sip_msg* msg) continue; sip_from_to* to = dynamic_cast(msg->to->p); - if(!to || to->tag.len != t->to_tag.len) + if (c2stlstr(to->tag) != t->to_tag) continue; if(msg->callid->value.len != t->msg->callid->value.len) @@ -406,9 +400,6 @@ sip_trans* trans_bucket::match_1xx_prack(sip_msg* msg) msg->callid->value.len)) continue; - if(memcmp(to->tag.s,t->to_tag.s,to->tag.len)) - continue; - return t; }