next_branches(): Fix infinite looping during error handling

liviuchircu · liviuchircu · commit 244cc92919c1 · 2022-11-17T09:25:30.000+02:00
If someone has actually taken the time to corrupt the internal
"$avp(serial_branch)" AVP, do not perform the "infinite while loop dance"
and correctly progress to the next AVP.
diff --git a/serialize.c b/serialize.c
@@ -368,7 +368,7 @@ int next_branches( struct sip_msg *msg)
 
 		if (!val.s.s) {
 			LM_ERR("invalid avp value\n");
-			continue;
+			goto next_avp;
 		}
 
 		p = val.s.s;
@@ -402,6 +402,7 @@ int next_branches( struct sip_msg *msg)
 			goto error1;
 		}
 
+	next_avp:
 		last_parallel_fork = (avp->flags & Q_FLAG);
 		prev = avp;
 		avp = search_next_avp(avp, &val);

Original file line number	Diff line number	Diff line change
`@@ -368,7 +368,7 @@ int next_branches( struct sip_msg *msg)`
`368`	`368`
`369`	`369`	`if (!val.s.s) {`
`370`	`370`	`LM_ERR("invalid avp value\n");`
`371`		`- continue;`
	`371`	`+ goto next_avp;`
`372`	`372`	`}`
`373`	`373`
`374`	`374`	`p = val.s.s;`
`@@ -402,6 +402,7 @@ int next_branches( struct sip_msg *msg)`
`402`	`402`	`goto error1;`
`403`	`403`	`}`
`404`	`404`
	`405`	`+ next_avp:`
`405`	`406`	`last_parallel_fork = (avp->flags & Q_FLAG);`
`406`	`407`	`prev = avp;`
`407`	`408`	`avp = search_next_avp(avp, &val);`