From aba95f88bf7b47dc9ad9021928350db16a6362dd Mon Sep 17 00:00:00 2001 From: Donat Zenichev Date: Tue, 29 Apr 2025 20:20:06 +0200 Subject: [PATCH] MT#59962 _trans_layer: `send_request()` check `p_msg` before using The memory referenced via it could have been freed already (by the `update_uac_request()`). Set the original pointer to NULL and check in the caller's function if it has been assigned to NULL before actually using. Fixes: Read from pointer after free (USE_AFTER_FREE) 41. deref_after_free: Dereferencing freed pointer p_msg. Change-Id: I07ee9360f996c8723ba46c99f512ef9562ff75c3 --- core/sip/trans_layer.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/core/sip/trans_layer.cpp b/core/sip/trans_layer.cpp index 72841e33..51a4222c 100644 --- a/core/sip/trans_layer.cpp +++ b/core/sip/trans_layer.cpp @@ -1364,7 +1364,8 @@ int _trans_layer::send_request(sip_msg* msg, trans_ticket* tt, msg_buffer = tt->_t->retr_buf; msg_len = tt->_t->retr_len; } - else { + /* p_msg could have been freed already by update_uac_request() */ + else if (p_msg) { msg_buffer = p_msg->buf; msg_len = p_msg->len; } @@ -2098,7 +2099,9 @@ int _trans_layer::update_uac_request(trans_bucket* bucket, sip_trans*& t, t->retr_socket = msg->local_socket; // remove the message; + delete msg; + msg = NULL; } return 0;