Changes in libfdproto/messages.c [903:4382d7420e65:924:877592751fee] in freeDiameter

File:

• libfdproto/messages.c (modified) (7 diffs)

libfdproto/messages.c

@@ -106 +106 @@
 #define _A(_x) ((struct avp *)(_x))
 /* Check the type and eyecatcher */
-#define CHECK_AVP(_x) ((_C(_x)->type == MSG_AVP) && (_A(_x)->avp_eyec == MSG_AVP_EYEC))
+#define CHECK_AVP(_x) ((_x) && (_C(_x)->type == MSG_AVP) && (_A(_x)->avp_eyec == MSG_AVP_EYEC))
 
 /* The following structure represents an instance of a message (command and children AVPs). */
@@ -239 +239 @@
                 if (new->avp_rawlen) {
                         CHECK_MALLOC(  new->avp_rawdata = malloc(new->avp_rawlen)  );
-                        memset(new->avp_rawdata, 0xFF, new->avp_rawlen);
+                        memset(new->avp_rawdata, 0x00, new->avp_rawlen);
                 }
         }
@@ -1216 +1216 @@
 }
 
+/* Associate a session with a message, use only when the session was just created */
+int fd_msg_sess_set(struct msg * msg, struct session * session)
+{
+        TRACE_ENTRY("%p %p", msg, session);
+        
+        /* Check we received valid parameters */
+        CHECK_PARAMS( CHECK_MSG(msg) );
+        CHECK_PARAMS( session );
+        CHECK_PARAMS( msg->msg_sess == NULL );
+        
+        msg->msg_sess = session;
+        return 0;
+}
+
 
 /* Retrieve the session of the message */
@@ -1261 +1275 @@
         
         /* Resolve the session and we are done */
-        CHECK_FCT( fd_sess_fromsid_msg ( avp->avp_public.avp_value->os.data, avp->avp_public.avp_value->os.len, &msg->msg_sess, new) );
-        *session = msg->msg_sess;
+        if (avp->avp_public.avp_value->os.len > 0) {
+                CHECK_FCT( fd_sess_fromsid_msg ( avp->avp_public.avp_value->os.data, avp->avp_public.avp_value->os.len, &msg->msg_sess, new) );
+                *session = msg->msg_sess;
+        } else {
+                TRACE_DEBUG(FULL, "Session-Id AVP with 0-byte length found in message %p", msg);
+                *session = NULL;
+        }
         
         return 0;
@@ -1648 +1667 @@
                 struct avp * avp;
                 
-                if (buflen - offset <= AVPHDRSZ_NOVEND) {
+                if (buflen - offset < AVPHDRSZ_NOVEND) {
                         TRACE_DEBUG(INFO, "truncated buffer: remaining only %d bytes", buflen - offset);
                         return EBADMSG;
@@ -1666 +1685 @@
                 
                 if (avp->avp_public.avp_flags & AVP_FLAG_VENDOR) {
-                        if (buflen - offset <= 4) {
+                        if (buflen - offset < 4) {
                                 TRACE_DEBUG(INFO, "truncated buffer: remaining only %d bytes for vendor and data", buflen - offset);
                                 free(avp);
@@ -1676 +1695 @@
                 
                 /* Check there is enough remaining data in the buffer */
-                if (buflen - offset < avp->avp_public.avp_len - GETAVPHDRSZ(avp->avp_public.avp_flags)) {
+                if ( (avp->avp_public.avp_len > GETAVPHDRSZ(avp->avp_public.avp_flags))
+                && (buflen - offset < avp->avp_public.avp_len - GETAVPHDRSZ(avp->avp_public.avp_flags))) {
                         TRACE_DEBUG(INFO, "truncated buffer: remaining only %d bytes for data, and avp data size is %d", 
                                         buflen - offset,