From 4efccb20a2b5ebb2185cd3e6f9eea17d5eee4394 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Germ=C3=A1n=20Luis=20Aracil=20Boned?= Date: Sun, 5 Jul 2026 21:40:01 +0200 Subject: [PATCH] sip_parser: fail closed if the message separator cannot be allocated sip_complete_message() created the trailing separator with sip_separator_create() but never checked the result before the multipart path dereferences sip->sip_separator->sep_common. If the allocation fails the separator stays NULL and the message is dereferenced through a NULL pointer. Return -1 (the function's existing error contract) when the separator cannot be allocated. Fixes #312. --- libsofia-sip-ua/sip/sip_parser.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libsofia-sip-ua/sip/sip_parser.c b/libsofia-sip-ua/sip/sip_parser.c index f4da2b297..56c6e764b 100644 --- a/libsofia-sip-ua/sip/sip_parser.c +++ b/libsofia-sip-ua/sip/sip_parser.c @@ -668,8 +668,9 @@ int sip_complete_message(msg_t *msg) if (sip == NULL) return -1; - if (!sip->sip_separator) - sip->sip_separator = sip_separator_create(msg_home(msg)); + if (!sip->sip_separator && + !(sip->sip_separator = sip_separator_create(msg_home(msg)))) + return -1; if (sip->sip_multipart) { sip_content_type_t *c = sip->sip_content_type;