tmx: safety check of expected route blocks for using $T_*() variables

- related to GH #2479 (cherry picked from commit 2e7710e)
kamailio · Oct 2, 2020 · 8988b12 · 8988b12
1 parent 0d0085c
commit 8988b12
Showing 1 changed file with 20 additions and 0 deletions.
diff --git a/src/modules/tmx/t_var.c b/src/modules/tmx/t_var.c
@@ -305,6 +305,11 @@ int pv_get_t_var_req(struct sip_msg *msg,  pv_param_t *param,
 {
 	pv_spec_t *pv=NULL;
 
+	if(!is_route_type(CORE_ONREPLY_ROUTE|TM_ONREPLY_ROUTE)) {
+		LM_DBG("used in unsupported route block - type %d\n", get_route_type());
+		return pv_get_null(msg, param, res);
+	}
+
 	if(pv_t_update_req(msg))
 		return pv_get_null(msg, param, res);
 
@@ -320,6 +325,11 @@ int pv_get_t_var_rpl(struct sip_msg *msg,  pv_param_t *param,
 {
 	pv_spec_t *pv=NULL;
 
+	if(!is_route_type(FAILURE_ROUTE|BRANCH_FAILURE_ROUTE)) {
+		LM_DBG("used in unsupported route block - type %d\n", get_route_type());
+		return pv_get_null(msg, param, res);
+	}
+
 	if(pv_t_update_rpl(msg))
 		return pv_get_null(msg, param, res);
 
@@ -335,6 +345,11 @@ int pv_get_t_var_branch(struct sip_msg *msg,  pv_param_t *param,
 {
 	pv_spec_t *pv=NULL;
 
+	if(!is_route_type(FAILURE_ROUTE|BRANCH_FAILURE_ROUTE|TM_ONREPLY_ROUTE)) {
+		LM_DBG("used in unsupported route block - type %d\n", get_route_type());
+		return pv_get_null(msg, param, res);
+	}
+
 	if(pv_t_update_rpl(msg))
 		return pv_get_null(msg, param, res);
 
@@ -350,6 +365,11 @@ int pv_get_t_var_inv(struct sip_msg *msg,  pv_param_t *param,
 {
 	pv_spec_t *pv=NULL;
 
+	if(!is_route_type(REQUEST_ROUTE)) {
+		LM_DBG("used in unsupported route block - type %d\n", get_route_type());
+		return pv_get_null(msg, param, res);
+	}
+
 	if(pv_t_update_inv(msg))
 		return pv_get_null(msg, param, res);