From b53cc77158afe4c7aa77b1c55944aa51cad2cb51 Mon Sep 17 00:00:00 2001
From: Richard Fuchs <rfuchs@sipwise.com>
Date: Thu, 1 Feb 2018 08:38:03 -0500
Subject: [PATCH] TT#31752 fix segfault on empty a=rtcp

Change-Id: I4f4494a552dd9bcd6f83f32a846cce1c18be8bc1
(cherry picked from commit 7b4424091b68cfb7b91f649d964d81f0a289a265)
---
 daemon/sdp.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/daemon/sdp.c b/daemon/sdp.c
index 9d9e38094..fe9941b9f 100644
--- a/daemon/sdp.c
+++ b/daemon/sdp.c
@@ -186,6 +186,7 @@ struct sdp_attribute {
 		ATTR_FINGERPRINT,
 		ATTR_SETUP,
 		ATTR_RTPMAP,
+		ATTR_IGNORE,
 	} attr;
 
 	union {
@@ -552,14 +553,16 @@ error:
 static int parse_attribute_rtcp(struct sdp_attribute *output) {
 	char *ep, *start, *end;
 
-	end = output->value.s + output->value.len;
+	if (!output->value.s)
+		goto err;
 	output->attr = ATTR_RTCP;
+	end = output->value.s + output->value.len;
 	output->u.rtcp.port_num = strtol(output->value.s, &ep, 10);
 	if (ep == output->value.s)
-		return -1;
+		goto err;
 	if (output->u.rtcp.port_num <= 0 || output->u.rtcp.port_num > 0xffff) {
 		output->u.rtcp.port_num = 0;
-		return -1;
+		goto err;
 	}
 	if (*ep != ' ')
 		return 0;
@@ -571,6 +574,11 @@ static int parse_attribute_rtcp(struct sdp_attribute *output) {
 	EXTRACT_NETWORK_ADDRESS(u.rtcp.address);
 
 	return 0;
+
+err:
+	ilog(LOG_WARN, "Failed to parse a=rtcp attribute, ignoring");
+	output->attr = ATTR_IGNORE;
+	return 0;
 }
 
 static int parse_attribute_candidate(struct sdp_attribute *output) {
@@ -1562,6 +1570,7 @@ static int process_session_attributes(struct sdp_chopper *chop, struct sdp_attri
 			case ATTR_SENDRECV:
 			case ATTR_FINGERPRINT:
 			case ATTR_SETUP:
+			case ATTR_IGNORE:
 				goto strip;
 
 			case ATTR_GROUP: