parse_via_param(): Fix out-of-bounds read edge-case (OSS-Fuzz)

Similar to 5e9f72d, but for the parse_via_param() function.

Severity: Low
Fixes OSS-Fuzz#53080

(cherry picked from commit 6135ff0)

parser/parse_via.c

@@ -742,7 +742,7 @@ static /*inline*/ char* parse_via_param(char* p, char* end,
 
  find_value:
 	tmp++;
-	for(;*tmp;tmp++){
+	for(;tmp<end;tmp++){
 		switch(*tmp){
 			case ' ':
 			case '\t':
@@ -909,6 +909,9 @@ static /*inline*/ char* parse_via_param(char* p, char* end,
 						goto parse_error;
 				}
 				break;
+			case '\0':
+				break;
+
 			default:
 				switch(state){
 					case F_VALUE:

parser/test/test_parser.c

@@ -163,16 +163,18 @@ static const struct tts {
 		/* test for read overflow on Via header (the @end pointer) */
 		"Q e  M\nV:SIP/2.0  /1P 4rr;TT;TT;TT;TT;TT;TT;T\xd2;TT;",
 		-1,
+	}, {
+		/* test for read overflow on Via header param (the @end pointer) */
+		"A  !\nV:SIP/2.0/? M;recEIVeD\n ",
+		-1,
 	},
-
-	{"\0", 0},
 };
 
 void test_parse_msg(void)
 {
 	int i;
 
-	for (i = 0; tset[i].tmsg[0]; i++) {
+	for (i = 0; i < sizeof tset/sizeof *tset; i++) {
 		struct sip_msg msg;
 
 		memset(&msg, 0, sizeof msg);