[Linphone-developers] Seg Fault - null realm pointer passed to ms_message/vnsprintf

[will barbour]

I have just started playing with the Linphone SDK to see if I might put it on QNX for blackberry phones/tablets. To this end I have created a proof of concept application based on the basic registration tutorial.

http://ftp.igh.cnrs.fr/pub/nongnu//linphone/docs/liblinphone/group__registration__tutorials.html

Which includes the snippet:

                LinphoneAuthInfo *info;
                if (password!=NULL){
                        info=linphone_auth_info_new(linphone_address_get_username(from),NULL,password,NULL,NULL); /*create authentication structure from identity*/
                        linphone_core_add_auth_info(lc,info); /*add authentication info to LinphoneCore*/
                }

Which adds an auth info structure with `realm` being set to NULL

This fact seems to cause a seg fault because of the `ms_message` call in linphone/coreapi/sal_eXosip2.c : push_auth_to_exosip

static void push_auth_to_exosip(const SalAuthInfo *info){

const char *userid;

if (info->userid==NULL || info->userid[0]=='\0') userid=info->username;

else userid=info->userid;

 

ms_message("Authentication info for username [%s], id[%s], realm [%s] added to eXosip", info->username,userid, realm);

eXosip_add_authentication_info (info->username,userid,

                                  info->password, NULL,info->realm);

}

 

`realm` is NULL, eventually causing `vsnprintf` to try to de-reference a null pointer!

On a lot of platforms we have the nice glibc feature which will automatically interpret a null pointer and print out "(null)", but sadly not on QNX!