Commit 349f55ff54 for freeswitch.com

commit 349f55ff546ab365f026eb254965af98232f81a9
Author: Dmitry Verenitsin <morbit85@gmail.com>
Date:   Sat Aug 8 21:54:01 2026 +0500

    Merge commit from fork

    In `msrp_parse_buffer()`, the `range_star` arm of `MSRP_ST_WAIT_BODY`
    computed the body length by subtracting the delimiter length and trailing
    framing from the received segment length. `payload_bytes` is a
    `switch_size_t`, so a short segment wrapped it to near `SIZE_MAX`, which
    `switch_msrp_msg_set_payload()` uses to size its allocation and as the
    `memcpy` length. This affects both `len - dlen - 5`, whose scan pointer
    also addressed memory before `buf`, and `delim_pos - buf - 2`, covered
    only by a `switch_assert()` on received data.

    Require room for the trailing end-line and the CRLF closing the body
    before either is computed; a short segment is incomplete, so the parser
    waits for more bytes.

diff --git a/src/switch_msrp.c b/src/switch_msrp.c
index 89b2a886c6..f1a2d75cf2 100644
--- a/src/switch_msrp.c
+++ b/src/switch_msrp.c
@@ -918,6 +918,14 @@ static switch_msrp_msg_t *msrp_parse_buffer(char *buf, int len, switch_msrp_msg_
 			switch_assert(msrp_msg->delimiter);
 			dlen = strlen(msrp_msg->delimiter);

+			/* Need room for the trailing delimiter framing; a shorter
+			   segment is incomplete, so keep waiting for more bytes. */
+			if (len < dlen + 5) {
+				msrp_msg->last_p = buf;
+
+				return msrp_msg;
+			}
+
 			if (!strncmp(buf + len - dlen - 3, msrp_msg->delimiter, dlen)) { /*bingo*/
 				payload_bytes = len - dlen - 5;
 				switch_msrp_msg_set_payload(msrp_msg, buf, payload_bytes);
@@ -932,7 +940,14 @@ static switch_msrp_msg_t *msrp_parse_buffer(char *buf, int len, switch_msrp_msg_
 				if (globals.debug) {
 					switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR, "=======================================delimiter: %s\n", delim_pos);
 				}
-				switch_assert(delim_pos - buf >= 2);
+				/* The delimiter must be preceded by the CRLF that closes the body;
+				   any earlier position leaves no body to take, so keep waiting. */
+				if (delim_pos - buf < 2) {
+					msrp_msg->last_p = buf;
+
+					return msrp_msg;
+				}
+
 				payload_bytes = delim_pos - buf - 2;
 				switch_msrp_msg_set_payload(msrp_msg, buf, payload_bytes);
 				msrp_msg->byte_end = msrp_msg->byte_start + msrp_msg->payload_bytes - 1;