Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ims_registrar_scscf: fix uninitialized access of memory, minor refactors #3787

Merged
merged 4 commits into from
Apr 29, 2024
Merged

ims_registrar_scscf: fix uninitialized access of memory, minor refactors #3787

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1931fc5
ims_registrar_scscf: fix uninitialized arguments in save()
lynxis Mar 1, 2024
ddd2237
ims_registrar_scscf: refactor save_fixup4
lynxis Mar 4, 2024
95dcc0c
ims_registrar_scscf: fix typo in function name uint_fixup
lynxis Mar 4, 2024
cc6e866
ims_registrar_scscf: free_uint_fixup: fix memleak/freeing the wrong p…
lynxis Mar 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
55 changes: 26 additions & 29 deletions src/modules/ims_registrar_scscf/ims_registrar_scscf_mod.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,9 @@ struct _pv_req_data _pv_treq;
static int mod_init(void);
static int child_init(int);
static void mod_destroy(void);
static int w_save(
static int w_save2(struct sip_msg *_m, char *_route, char *_d);
static int w_save3(struct sip_msg *_m, char *_route, char *_d, char *mode);
static int w_save4(
struct sip_msg *_m, char *_route, char *_d, char *mode, char *_cflags);
static int w_assign_server_unreg(
struct sip_msg *_m, char *_route, char *_d, char *_direction);
Expand All @@ -143,7 +145,7 @@ static int w_lookup_path_to_contact(struct sip_msg *_m, char *contact_uri);
static int domain_fixup(void **param, int param_no);
static int assign_save_fixup3_async(void **param, int param_no);
static int free_uint_fixup(void **param, int param_no);
static int save_fixup3(void **param, int param_no);
static int save_fixup4(void **param, int param_no);
static int unreg_fixup(void **param, int param_no);
static int fetchc_fixup(void **param, int param_no);
/*! \brief Functions */
Expand Down Expand Up @@ -231,11 +233,11 @@ static pv_export_t mod_pvs[] = {
* Exported functions
*/
static cmd_export_t cmds[] = {
{"save", (cmd_function)w_save, 2, assign_save_fixup3_async, 0,
{"save", (cmd_function)w_save2, 2, assign_save_fixup3_async, 0,
REQUEST_ROUTE | ONREPLY_ROUTE},
{"save", (cmd_function)w_save, 3, assign_save_fixup3_async, 0,
{"save", (cmd_function)w_save3, 3, assign_save_fixup3_async, 0,
REQUEST_ROUTE | ONREPLY_ROUTE},
{"save", (cmd_function)w_save, 4, save_fixup3, free_uint_fixup,
{"save", (cmd_function)w_save4, 4, save_fixup4, free_uint_fixup,
REQUEST_ROUTE | ONREPLY_ROUTE},
{"lookup", (cmd_function)w_lookup, 1, domain_fixup, 0,
REQUEST_ROUTE | FAILURE_ROUTE},
Expand Down Expand Up @@ -677,9 +679,21 @@ AAAMessage *callback_cdp_request(AAAMessage *request, void *param)
/*! \brief
* Wrapper to save(location)
*/
static int w_save(
static int w_save2(struct sip_msg *_m, char *_route, char *_d)
{
return save(_m, _d, _route, 0);
}

static int w_save3(struct sip_msg *_m, char *_route, char *_d, char *_mode)
{
/* mode is unsed. Docs says legacy parameter? Maybe to be compatible with registrar/save? */
return save(_m, _d, _route, 0);
}

static int w_save4(
struct sip_msg *_m, char *_route, char *_d, char *mode, char *_cflags)
{
/* mode is unsed. Docs says legacy parameter? Maybe to be compatible with registrar/save? */
if(_cflags) {
return save(_m, _d, _route, ((int)(*_cflags)));
}
Expand Down Expand Up @@ -772,7 +786,7 @@ static int assign_save_fixup3_async(void **param, int param_no)
return 0;
}

static int unit_fixup(void **param, int param_no)
static int uint_fixup(void **param, int param_no)
{
str s;
unsigned int *num;
Expand Down Expand Up @@ -800,36 +814,19 @@ static int unit_fixup(void **param, int param_no)

static int free_uint_fixup(void **param, int param_no)
{
if(*param && param_no == 2) {
if(*param && param_no == 4) {
pkg_free(*param);
*param = 0;
}
return 0;
}

static int save_fixup3(void **param, int param_no)
static int save_fixup4(void **param, int param_no)
{
if(strlen((char *)*param) <= 0) {
LM_ERR("empty parameter %d not allowed\n", param_no);
return -1;
}

if(param_no == 1) { //route name - static or dynamic string (config vars)
if(fixup_spve_null(param, param_no) < 0)
return -1;
return 0;
} else if(param_no == 2) {
udomain_t *d;

if(ul.register_udomain((char *)*param, &d) < 0) {
LM_ERR("Error doing fixup on save");
return -1;
}
*param = (void *)d;
} else if(param_no == 3) {
return 0;
if(param_no < 4) {
return assign_save_fixup3_async(param, param_no);
} else if(param_no == 4) {
return unit_fixup(param, param_no);
return uint_fixup(param, param_no);
}

return 0;
Expand Down