+++ /dev/null
-From db3235953baa56d2fb0e276ca510fefca751643f Mon Sep 17 00:00:00 2001
-From: Nanang Izzuddin <nanang@teluu.com>
-Date: Mon, 21 Feb 2022 06:24:52 +0700
-Subject: [PATCH] Merge pull request from GHSA-ffff-m5fm-qm62
-
-* Update pjsip_ua_unregister_dlg():
-- update the hash key if the dialog being unregistered is used as hash key.
-- add an assertion check to make sure that the dlg_set to be removed is valid (can be found in the hash table).
-
-* Change hash key string comparison method.
----
- pjsip/src/pjsip/sip_ua_layer.c | 48 +++++++++++++++++++++++++++++-----
- 1 file changed, 42 insertions(+), 6 deletions(-)
-
---- a/pjsip/src/pjsip/sip_ua_layer.c
-+++ b/pjsip/src/pjsip/sip_ua_layer.c
-@@ -65,6 +65,9 @@ struct dlg_set
- /* This is the buffer to store this entry in the hash table. */
- pj_hash_entry_buf ht_entry;
-
-+ /* Entry key in the hash table */
-+ pj_str_t ht_key;
-+
- /* List of dialog in this dialog set. */
- struct dlg_set_head dlg_list;
- };
-@@ -321,6 +324,7 @@ PJ_DEF(pj_status_t) pjsip_ua_register_dl
- * Create the dialog set and add this dialog to it.
- */
- dlg_set = alloc_dlgset_node();
-+ dlg_set->ht_key = dlg->local.info->tag;
- pj_list_init(&dlg_set->dlg_list);
- pj_list_push_back(&dlg_set->dlg_list, dlg);
-
-@@ -328,8 +332,8 @@ PJ_DEF(pj_status_t) pjsip_ua_register_dl
-
- /* Register the dialog set in the hash table. */
- pj_hash_set_np_lower(mod_ua.dlg_table,
-- dlg->local.info->tag.ptr,
-- (unsigned)dlg->local.info->tag.slen,
-+ dlg_set->ht_key.ptr,
-+ (unsigned)dlg_set->ht_key.slen,
- dlg->local.tag_hval, dlg_set->ht_entry,
- dlg_set);
- }
-@@ -339,14 +343,15 @@ PJ_DEF(pj_status_t) pjsip_ua_register_dl
- struct dlg_set *dlg_set;
-
- dlg_set = alloc_dlgset_node();
-+ dlg_set->ht_key = dlg->local.info->tag;
- pj_list_init(&dlg_set->dlg_list);
- pj_list_push_back(&dlg_set->dlg_list, dlg);
-
- dlg->dlg_set = dlg_set;
-
- pj_hash_set_np_lower(mod_ua.dlg_table,
-- dlg->local.info->tag.ptr,
-- (unsigned)dlg->local.info->tag.slen,
-+ dlg_set->ht_key.ptr,
-+ (unsigned)dlg_set->ht_key.slen,
- dlg->local.tag_hval, dlg_set->ht_entry, dlg_set);
- }
-
-@@ -391,12 +396,43 @@ PJ_DEF(pj_status_t) pjsip_ua_unregister_
-
- /* If dialog list is empty, remove the dialog set from the hash table. */
- if (pj_list_empty(&dlg_set->dlg_list)) {
-- pj_hash_set_lower(NULL, mod_ua.dlg_table, dlg->local.info->tag.ptr,
-- (unsigned)dlg->local.info->tag.slen,
-+
-+ /* Verify that the dialog set is valid */
-+ pj_assert(pj_hash_get_lower(mod_ua.dlg_table, dlg_set->ht_key.ptr,
-+ (unsigned)dlg_set->ht_key.slen,
-+ &dlg->local.tag_hval) == dlg_set);
-+
-+ pj_hash_set_lower(NULL, mod_ua.dlg_table, dlg_set->ht_key.ptr,
-+ (unsigned)dlg_set->ht_key.slen,
- dlg->local.tag_hval, NULL);
-
- /* Return dlg_set to free nodes. */
- pj_list_push_back(&mod_ua.free_dlgset_nodes, dlg_set);
-+ } else {
-+ /* If the just unregistered dialog is being used as hash key,
-+ * reset the dlg_set entry with a new key (i.e: from the first dialog
-+ * in dlg_set).
-+ */
-+ if (dlg_set->ht_key.ptr == dlg->local.info->tag.ptr &&
-+ dlg_set->ht_key.slen == dlg->local.info->tag.slen)
-+ {
-+ pjsip_dialog* key_dlg = dlg_set->dlg_list.next;
-+
-+ /* Verify that the old & new keys share the hash value */
-+ pj_assert(key_dlg->local.tag_hval == dlg->local.tag_hval);
-+
-+ pj_hash_set_lower(NULL, mod_ua.dlg_table, dlg_set->ht_key.ptr,
-+ (unsigned)dlg_set->ht_key.slen,
-+ dlg->local.tag_hval, NULL);
-+
-+ dlg_set->ht_key = key_dlg->local.info->tag;
-+
-+ pj_hash_set_np_lower(mod_ua.dlg_table,
-+ dlg_set->ht_key.ptr,
-+ (unsigned)dlg_set->ht_key.slen,
-+ key_dlg->local.tag_hval, dlg_set->ht_entry,
-+ dlg_set);
-+ }
- }
-
- /* Unlock user agent. */