[core] coverity CID 1468449 (Out-of-bounds access)

src/mod/applications/mod_spandsp/mod_spandsp_modem.c

@@ -897,9 +897,7 @@ static switch_call_cause_t channel_outgoing_channel(switch_core_session_t *sessi
 
 	fail:
 
-		if (new_session) {
-			switch_core_session_destroy(new_session);
-		}
+		switch_core_session_destroy(new_session);
 
 		if (modem) {
 			modem_set_state(modem, MODEM_STATE_ONHOOK);

src/mod/endpoints/mod_portaudio/mod_portaudio.c

@@ -1296,9 +1296,9 @@ error:
 		}
 		switch_mutex_unlock(endpoint->mutex);
 	}
-	if (new_session && *new_session) {
-		switch_core_session_destroy(new_session);
-	}
+
+	switch_core_session_destroy(new_session);
+
 	return retcause;
 }
 

src/mod/endpoints/mod_sofia/mod_sofia.c

@@ -472,7 +472,7 @@ switch_status_t sofia_on_hangup(switch_core_session_t *session)
 		switch_core_hash_delete_locked(tech_pvt->profile->chat_hash, tech_pvt->hash_key, tech_pvt->profile->flag_mutex);
 	}
 
-	if (session && tech_pvt->profile->pres_type) {
+	if (tech_pvt->profile->pres_type) {
 		char *sql = switch_mprintf("delete from sip_dialogs where uuid='%q'", switch_core_session_get_uuid(session));
 		switch_assert(sql);
 		sofia_glue_execute_sql_now(tech_pvt->profile, &sql, SWITCH_TRUE);
@@ -2205,11 +2205,7 @@ static switch_status_t sofia_receive_message(switch_core_session_t *session, swi
 													argv[i], (double)((double)(MAX_REDIR + 1 - i))/1000);
 								}
 							} else {
-								if (i == argc - 1) {
-									switch_snprintf(newdest + strlen(newdest), len - strlen(newdest), "\"unknown\" <%s>", argv[i]);
-								} else {
-									switch_snprintf(newdest + strlen(newdest), len - strlen(newdest), "\"unknown\" <%s>,", argv[i]);
-								}
+								switch_snprintf(newdest + strlen(newdest), len - strlen(newdest), "\"unknown\" <%s>", argv[i]);
 							}
 						} else {
 							if (i == argc - 1) {
@@ -4313,6 +4309,8 @@ SWITCH_STANDARD_API(sofia_presence_data_function)
 		user = argv[1];
 	}
 
+	if (!user) goto end;
+
 	if ((domain = strchr(user, '@'))) {
 		*domain++ = '\0';
 		if ((concat = strchr(domain, '/'))) {
@@ -4329,8 +4327,6 @@ SWITCH_STANDARD_API(sofia_presence_data_function)
 		domain = dup_domain;
 	}
 
-	if (!user) goto end;
-
 	if (zstr(profile_name) || strcmp(profile_name, "*") || zstr(domain)) {
 		if (!zstr(profile_name)) {
 			profile = sofia_glue_find_profile(profile_name);

src/mod/endpoints/mod_sofia/sofia.c

@@ -2818,7 +2818,10 @@ void event_handler(switch_event_t *event)
 
 			if ((sptr = strstr(fixed_contact_str, needle))) {
 				char *origsptr = strstr(contact_str, needle);
-				eptr = strchr(++origsptr, ';');
+
+				if (origsptr) {
+					eptr = strchr(++origsptr, ';');
+				}
 			} else {
 				sptr = strchr(fixed_contact_str, '\0') - 1;
 			}

src/mod/endpoints/mod_sofia/sofia_glue.c

@@ -2282,8 +2282,7 @@ int sofia_recover_callback(switch_core_session_t *session)
 	switch_channel_t *channel = switch_core_session_get_channel(session);
 	private_object_t *tech_pvt = NULL;
 	sofia_profile_t *profile = NULL;
-	const char *tmp;
-	const char *rr;
+	const char *tmp, *rr, *use_uuid;
 	int r = 0;
 	const char *profile_name = switch_channel_get_variable_dup(channel, "recovery_profile_name", SWITCH_FALSE, -1);
 	int swap = switch_channel_var_true(channel, "dlg_req_swap_direction");
@@ -2374,17 +2373,13 @@ int sofia_recover_callback(switch_core_session_t *session)
 										   );
 	}
 
-	if (session) {
-		const char *use_uuid;
-
-		if ((use_uuid = switch_channel_get_variable(channel, "origination_uuid"))) {
-			if (switch_core_session_set_uuid(session, use_uuid) == SWITCH_STATUS_SUCCESS) {
-				switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(session), SWITCH_LOG_DEBUG, "%s set UUID=%s\n", switch_channel_get_name(channel),
-								  use_uuid);
-			} else {
-				switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(session), SWITCH_LOG_CRIT, "%s set UUID=%s FAILED\n",
-								  switch_channel_get_name(channel), use_uuid);
-			}
+	if ((use_uuid = switch_channel_get_variable(channel, "origination_uuid"))) {
+		if (switch_core_session_set_uuid(session, use_uuid) == SWITCH_STATUS_SUCCESS) {
+			switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(session), SWITCH_LOG_DEBUG, "%s set UUID=%s\n", switch_channel_get_name(channel),
+							  use_uuid);
+		} else {
+			switch_log_printf(SWITCH_CHANNEL_SESSION_LOG(session), SWITCH_LOG_CRIT, "%s set UUID=%s FAILED\n",
+							  switch_channel_get_name(channel), use_uuid);
 		}
 	}
 

src/mod/endpoints/mod_verto/mod_verto.c

@@ -836,7 +836,7 @@ static void set_perm(const char *str, switch_event_t **event, switch_bool_t add)
 		switch_event_create(event, SWITCH_EVENT_REQUEST_PARAMS);
 	}
 	
-	if (!zstr(str)) {
+	if (!zstr(str) && event && *event) {
 		edup = strdup(str);
 		switch_assert(edup);
 
@@ -1059,7 +1059,7 @@ static switch_bool_t check_auth(jsock_t *jsock, cJSON *params, int *code, char *
 			*code = CODE_AUTH_FAILED;
 			switch_snprintf(message, mlen, "Login Incorrect");
 			login_fire_custom_event(jsock, params, 0, "Login Incorrect");
-			switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_WARNING, "Login incorrect for user: %s domain: %s\n", id, domain ? domain : "N/A");
+			switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_WARNING, "Login incorrect for user: %s domain: %s\n", id, domain);
 		} else {
 			switch_xml_t x_param, x_params;
 			const char *use_passwd = NULL, *verto_context = NULL, *verto_dialplan = NULL;
@@ -3954,7 +3954,7 @@ static switch_bool_t verto__invite_func(const char *method, cJSON *params, jsock
 	cJSON *obj = cJSON_CreateObject(), *vobj = NULL, *dedEnc = NULL, *mirrorInput, *bandwidth = NULL, *canvas = NULL;
 	switch_core_session_t *session = NULL;
 	switch_channel_t *channel;
-	switch_event_t *var_event;
+	switch_event_t *var_event = NULL;
 	switch_call_cause_t reason = SWITCH_CAUSE_INVALID_MSG_UNSPECIFIED, cancel_cause = 0;
 	switch_caller_profile_t *caller_profile;
 	int err = 0;
@@ -4756,14 +4756,12 @@ static int start_jsock(verto_profile_t *profile, ks_socket_t sock, int family)
 
  error:
 
-	if (jsock) {
-		if (jsock->client_socket != KS_SOCK_INVALID) {
-			close_socket(&jsock->client_socket);
-		}
-
-		switch_core_destroy_memory_pool(&pool);
+	if (jsock->client_socket != KS_SOCK_INVALID) {
+		close_socket(&jsock->client_socket);
 	}
 
+	switch_core_destroy_memory_pool(&pool);
+
 	return -1;
 }
 

src/switch_msrp.c

@@ -1745,8 +1745,8 @@ SWITCH_STANDARD_APP(msrp_send_file_function)
 	switch_memory_pool_t *pool = switch_core_session_get_pool(session);
 	switch_file_t *fd;
 	const char *filename = data;
-	switch_size_t len = 1024;
-	char buf[1024];
+	switch_size_t len = 4096;
+	char buf[4096];
 	int sanity = 10;
 
 	if (!(msrp_session = switch_core_media_get_msrp_session(session))) {