Fix out-of-bounds read in SIP parameter escape handling

The escape handler in VP_PVALUE_QUOTED checked for NUL terminator
after advancing the cursor, but the parser is bounded by an end
pointer, not NUL. A backslash at the last position would dereference
past the buffer. Check bounds against end pointer before incrementing.

Author: marcel

core/sip/parse_common.cpp

@@ -256,10 +256,11 @@ static int _parse_gen_params(list<sip_avp*>* params, const char** c,
 		break;
 
 	    case '\\':
-		if(!*(++(*c))){
+		if(*c + 1 >= end){
 		    DBG("Escape char in quoted str at EoT!!!\n");
 		    return MALFORMED_SIP_MSG;
 		}
+		++(*c);
 		break;
 	    }
 	    break;