neels has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-mgw/+/35263?usp=email )

Change subject: fix possible NULL deref on early media ......................................................................

fix possible NULL deref on early media

end.codec may be NULL, depending on whether a single matching codec could be found or not, i.e. based on external input. So let's not crash if an RTP packet arrives while end.codec == NULL.

Change-Id: I9bfb55a343b3f2b1459e0aba4ee71a6133b992b3 --- M src/libosmo-mgcp/mgcp_network.c 1 file changed, 16 insertions(+), 2 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/osmo-mgw refs/changes/63/35263/1

diff --git a/src/libosmo-mgcp/mgcp_network.c b/src/libosmo-mgcp/mgcp_network.c index 674c096..e37437d 100644 --- a/src/libosmo-mgcp/mgcp_network.c +++ b/src/libosmo-mgcp/mgcp_network.c @@ -1514,8 +1514,9 @@ return -1;

/* Handle AMR frame format conversion (octet-aligned vs. bandwith-efficient) */ - if (mc->proto == MGCP_PROTO_RTP && - mgcp_codec_amr_align_mode_is_indicated(conn_src->end.codec)) { + if (mc->proto == MGCP_PROTO_RTP + && conn_src->end.codec + && mgcp_codec_amr_align_mode_is_indicated(conn_src->end.codec)) { /* Make sure that the incoming AMR frame format matches the frame format that the call agent has * communicated via SDP when the connection was created/modfied. */ int oa = amr_oa_check((char*)msgb_data(msg), msgb_length(msg));