kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-11-17 07:18:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Resolve crashes due to large stack allocations when using TCP

Browse Source 
Asterisk had several places where messages received over various network
transports may be copied in a single stack allocation. In the case of TCP,
since multiple packets in a stream may be concatenated together, this can
lead to large allocations that overflow the stack.

This patch modifies those portions of Asterisk using TCP to either
favor heap allocations or use an upper bound to ensure that the stack will not
overflow:
 * For SIP, the allocation now has an upper limit
 * For HTTP, the allocation is now a heap allocation instead of a stack
   allocation
 * For XMPP (in res_jabber), the allocation has been eliminated since it was
   unnecesary.

Note that the HTTP portion of this issue was independently found by Brandon
Edwards of Exodus Intelligence.

(issue ASTERISK-20658)
Reported by: wdoekes, Brandon Edwards
Tested by: mmichelson, wdoekes
patches:
  ASTERISK-20658_res_jabber.c.patch uploaded by mmichelson (license 5049)
  issueA20658_http_postvars_use_malloc2.patch uploaded by wdoekes (license 5674)
  issueA20658_limit_sip_packet_size3.patch uploaded by wdoekes (license 5674)



git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@378269 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Matthew Jordan
2013-01-02 15:16:10 +00:00
parent 367bed142a
commit a73c5b80ff
4 changed files with 60 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
main/http.c
View File

@@ -622,6 +622,7 @@ struct ast_variable *ast_http_get_post_vars(
int content_length = 0;
struct ast_variable *v, *post_vars=NULL, *prev = NULL;
char *buf, *var, *val;
int res;
for (v = headers; v; v = v->next) {
if (!strcasecmp(v->name, "Content-Type")) {
@@ -634,20 +635,28 @@ struct ast_variable *ast_http_get_post_vars(
for (v = headers; v; v = v->next) {
if (!strcasecmp(v->name, "Content-Length")) {
content_length = atoi(v->value) + 1;
content_length = atoi(v->value);
break;
}
}
if (!content_length) {
if (content_length <= 0) {
return NULL;
}
buf = ast_alloca(content_length);
if (!fgets(buf, content_length, ser->f)) {
buf = ast_malloc(content_length + 1);
if (!buf) {
return NULL;
}
res = fread(buf, 1, content_length, ser->f);
if (res < content_length) {
/* Error, distinguishable by ferror() or feof(), but neither
* is good. */
goto done;
}
buf[content_length] = '\0';
while ((val = strsep(&buf, "&"))) {
var = strsep(&val, "=");
if (val) {
@@ -665,6 +674,9 @@ struct ast_variable *ast_http_get_post_vars(
prev = v;
}
}
done:
ast_free(buf);
return post_vars;
}