From 76b886da8ddf11a94a62850c19bad8c83bd113fc Mon Sep 17 00:00:00 2001
From: Daniel-Constantin Mierla <miconda@gmail.com>
Date: Thu, 11 Feb 2021 15:59:31 +0100
Subject: [PATCH] rr: use rr params with record_route_preset()

- param buffer was checked, but not used
---
 src/modules/rr/record.c | 86 +++++++++++++++++++++++++++++++----------
 src/modules/rr/record.h |  1 +
 src/modules/rr/rr_mod.c |  2 +
 3 files changed, 68 insertions(+), 21 deletions(-)

diff --git a/src/modules/rr/record.c b/src/modules/rr/record.c
index 604b3d2393b..083955803f8 100644
--- a/src/modules/rr/record.c
+++ b/src/modules/rr/record.c
@@ -504,11 +504,14 @@ int record_route_preset(struct sip_msg* _m, str* _data)
 	str user = {NULL, 0};
 	struct to_body* from = NULL;
 	struct lump* l;
-	char* hdr, *p;
-	int hdr_len;
+	struct lump* l2;
+	char *p;
+	str hdr = STR_NULL;
 	int use_ob = rr_obb.use_outbound ? rr_obb.use_outbound(_m) : 0;
 	char *rr_prefix;
 	int rr_prefix_len;
+	str suffix = STR_NULL;
+	str term = STR_NULL;
 	int sips = 0;
 	int ret = 0;
 
@@ -555,37 +558,47 @@ int record_route_preset(struct sip_msg* _m, str* _data)
 	}
 
 	l = anchor_lump(_m, _m->headers->name.s - _m->buf, 0, HDR_RECORDROUTE_T);
-	if (!l) {
-		LM_ERR("failed to create lump anchor\n");
+	l2 = anchor_lump(_m, _m->headers->name.s - _m->buf, 0, 0);
+	if (!l || !l2) {
+		LM_ERR("failed to create lump anchors\n");
 		ret = -3;
 		goto error;
 	}
 
-	hdr_len = rr_prefix_len;
+	hdr.len = rr_prefix_len;
 	if (user.len)
-		hdr_len += user.len + 1; /* @ */
-	hdr_len += _data->len;
+		hdr.len += user.len + 1; /* @ */
+	hdr.len += _data->len;
 
 	if (append_fromtag && from->tag_value.len) {
-		hdr_len += RR_FROMTAG_LEN + from->tag_value.len;
+		hdr.len += RR_FROMTAG_LEN + from->tag_value.len;
+	}
+
+	if (rr_param_buf.len > 0) {
+		hdr.len += rr_param_buf.len;
 	}
 
 	if (enable_full_lr) {
-		hdr_len += RR_LR_FULL_LEN;
+		suffix.len = RR_LR_FULL_LEN;
 	} else {
-		hdr_len += RR_LR_LEN;
+		suffix.len = RR_LR_LEN;
 	}
 
-	hdr_len += RR_TERM_LEN;
+	term.len = RR_TERM_LEN;
 
-	hdr = pkg_malloc(hdr_len);
-	if (!hdr) {
+	hdr.s = pkg_malloc(hdr.len);
+	suffix.s = pkg_malloc(suffix.len);
+	term.s = pkg_malloc(term.len);
+	if (!hdr.s || !suffix.s || !term.s) {
 		LM_ERR("no pkg memory left\n");
+		if(hdr.s) pkg_free(hdr.s);
+		if(suffix.s) pkg_free(suffix.s);
+		if(term.s) pkg_free(term.s);
 		ret = -4;
 		goto error;
 	}
 
-	p = hdr;
+	p = hdr.s;
 	memcpy(p, rr_prefix, rr_prefix_len);
 	p += rr_prefix_len;
 
@@ -606,22 +619,42 @@ int record_route_preset(struct sip_msg* _m, str* _data)
 		p += from->tag_value.len;
 	}
 
+	if (rr_param_buf.len > 0) {
+		memcpy(p, rr_param_buf.s, rr_param_buf.len);
+		p += rr_param_buf.len;
+	}
+
+
 	if (enable_full_lr) {
-		memcpy(p, RR_LR_FULL, RR_LR_FULL_LEN);
-		p += RR_LR_FULL_LEN;
+		memcpy(suffix.s, RR_LR_FULL, RR_LR_FULL_LEN);
 	} else {
-		memcpy(p, RR_LR, RR_LR_LEN);
-		p += RR_LR_LEN;
+		memcpy(suffix.s, RR_LR, RR_LR_LEN);
 	}
 
-	memcpy(p, RR_TERM, RR_TERM_LEN);
+	memcpy(term.s, RR_TERM, RR_TERM_LEN);
 
-	if (!insert_new_lump_after(l, hdr, hdr_len, 0)) {
+	if (!insert_new_lump_after(l, hdr.s, hdr.len, 0)) {
 		LM_ERR("failed to insert new lump\n");
-		pkg_free(hdr);
+		pkg_free(hdr.s);
+		pkg_free(suffix.s);
+		pkg_free(term.s);
 		ret = -5;
 		goto error;
 	}
+
+	l2 = insert_new_lump_before(l2, suffix.s, suffix.len, HDR_RECORDROUTE_T);
+	if (l2 == NULL) {
+		pkg_free(suffix.s);
+		pkg_free(term.s);
+		ret = -6;
+		goto error;
+	}
+	if (!(l2 = insert_new_lump_before(l2, term.s, term.len, 0))) {
+		pkg_free(term.s);
+		ret = -7;
+		goto error;
+	}
+
 	LM_DBG("inserted preset record route\n");
 	ret = 1;
 error:
@@ -948,3 +981,14 @@ int add_rr_param(struct sip_msg* msg, str* rr_param)
 error:
 	return -1;
 }
+
+/*!
+ * \brief Reset Record-Route parameters buffer
+ * \param msg SIP message
+ * \return 0 on success, -1 on failure
+ */
+void reset_rr_param(void)
+{
+	rr_param_buf.len = 0;
+	return;
+}
diff --git a/src/modules/rr/record.h b/src/modules/rr/record.h
index c76135863a2..fc3fb64d837 100644
--- a/src/modules/rr/record.h
+++ b/src/modules/rr/record.h
@@ -82,5 +82,6 @@ int add_rr_param(struct sip_msg* msg, str* rr_param);
 
 void init_custom_user(pv_spec_t *custom_user_avp);
 
+void reset_rr_param(void);
 
 #endif /* RECORD_H */
diff --git a/src/modules/rr/rr_mod.c b/src/modules/rr/rr_mod.c
index 3b57a3bd1b5..d9cfedfaf98 100644
--- a/src/modules/rr/rr_mod.c
+++ b/src/modules/rr/rr_mod.c
@@ -373,6 +373,8 @@ static int ki_record_route_preset(sip_msg_t *msg, str *addr1, str *addr2)
 		return -1;
 
 done:
+	reset_rr_param();
+
 	msg->msg_flags |= FL_RR_ADDED;
 	return 1;