Update for 15.6.2

AST-2018-010: Fix length of buffer needed for SRV and NAPTR results
When dn_expand was being called on SRV and NAPTR results, the return value was being used to calculate the size of the buffer needed to store the host names. Since dn_expand returns the length of the COMPRESSED name the buffer could be too short to hold the EXPANDED name. The expanded name is NULL terminated so using strlen() is the correct way to determine the length actually needed for the buffer. ASTERISK-28127 Reported by: Jan Hoffmann patches: patch.diff submitted by janhoffmann (license 6986) Change-Id: I4d35d6c431c6c6836cb61d37b1378cc47f0b414d
2025-08-23 13:53:03 +00:00 · 2018-11-14 10:33:38 -06:00 · 2018-11-14 09:26:12 -05:00 · 2018-09-26 08:14:53 -05:00 · 2018-09-20 11:19:51 -05:00 · 2018-09-17 07:29:12 -05:00
24 changed files with 85540 additions and 22 deletions
--- a/.lastclean
+++ b/.lastclean
@@ -0,0 +1 @@
+40
--- a/.version
+++ b/.version
@@ -0,0 +1 @@
+15.6.2
--- a/78534
+++ b/78534
--- a/asterisk-15.6.2-summary.html
+++ b/asterisk-15.6.2-summary.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><title>Release Summary - asterisk-15.6.2</title><h1 align="center"><a name="top">Release Summary</a></h1><h3 align="center">asterisk-15.6.2</h3><h3 align="center">Date: 2018-11-14</h3><h3 align="center">&lt;asteriskteam@digium.com&gt;</h3><hr><h2 align="center">Table of Contents</h2><ol>
+<li><a href="#summary">Summary</a></li>
+<li><a href="#contributors">Contributors</a></li>
+<li><a href="#closed_issues">Closed Issues</a></li>
+<li><a href="#commits">Other Changes</a></li>
+<li><a href="#diffstat">Diffstat</a></li>
+</ol><hr><a name="summary"><h2 align="center">Summary</h2></a><center><a href="#top">[Back to Top]</a></center><p>This release has been made to address one or more security vulnerabilities that have been identified. A security advisory document has been published for each vulnerability that includes additional information. Users of versions of Asterisk that are affected are strongly encouraged to review the advisories and determine what action they should take to protect their systems from these issues.</p><p>Security Advisories:</p><ul>
+<li><a href="http://downloads.asterisk.org/pub/security/AST-2018-010.html">AST-2018-010</a></li>
+</ul><p>The data in this summary reflects changes that have been made since the previous release, asterisk-15.6.1.</p><hr><a name="contributors"><h2 align="center">Contributors</h2></a><center><a href="#top">[Back to Top]</a></center><p>This table lists the people who have submitted code, those that have tested patches, as well as those that reported issues on the issue tracker that were resolved in this release. For coders, the number is how many of their patches (of any size) were committed into this release. For testers, the number is the number of times their name was listed as assisting with testing a patch. Finally, for reporters, the number is the number of issues that they reported that were affected by commits that went into this release.</p><table width="100%" border="0">
+<tr><th width="33%">Coders</th><th width="33%">Testers</th><th width="33%">Reporters</th></tr>
+<tr valign="top"><td width="33%">1 Jan Hoffmann <jan@3e8.eu><br/>1 George Joseph <gjoseph@digium.com><br/></td><td width="33%"><td width="33%">1 Jan Hoffmann <jan@3e8.eu><br/></td></tr>
+</table><hr><a name="closed_issues"><h2 align="center">Closed Issues</h2></a><center><a href="#top">[Back to Top]</a></center><p>This is a list of all issues from the issue tracker that were closed by changes that went into this release.</p><h3>Security</h3><h4>Category: Core/DNS</h4><a href="https://issues.asterisk.org/jira/browse/ASTERISK-28127">ASTERISK-28127</a>: Buffer overflow for DNS SRV/NAPTR records<br/>Reported by: Jan Hoffmann<ul>
+<li><a href="https://code.asterisk.org/code/changelog/asterisk?cs=ae857488d97f94535d7c4dbe6049ddcc211bcf32">[ae857488d9]</a> Jan Hoffmann -- AST-2018-010: Fix length of buffer needed for SRV and NAPTR results</li>
+</ul><br><hr><a name="commits"><h2 align="center">Commits Not Associated with an Issue</h2></a><center><a href="#top">[Back to Top]</a></center><p>This is a list of all changes that went into this release that did not reference a JIRA issue.</p><table width="100%" border="1">
+<tr><th>Revision</th><th>Author</th><th>Summary</th></tr>
+<tr><td><a href="https://code.asterisk.org/code/changelog/asterisk?cs=50bc875be6db48cbcaece56add2ebbca26dbb54b">50bc875be6</a></td><td>George Joseph</td><td>CI:  Add --test-timeout option to runTestsuite.sh</td></tr>
+</table><hr><a name="diffstat"><h2 align="center">Diffstat Results</h2></a><center><a href="#top">[Back to Top]</a></center><p>This is a summary of the changes to the source code that went into this release that was generated using the diffstat utility.</p><pre>asterisk-15.6.1-summary.html       |   26 -
+asterisk-15.6.1-summary.txt        |  112 -----
+b/.version                         |    2
+b/ChangeLog                        |   44 --
+b/asterisk-15.6.0-rc1-summary.html |  300 +++++++++++++++
+b/asterisk-15.6.0-rc1-summary.txt  |  733 +++++++++++++++++++++++++++++++++++++
+b/main/dns_naptr.c                 |   14
+b/main/dns_srv.c                   |   12
+b/tests/CI/gateTestGroups.json     |    9
+9 files changed, 1063 insertions(+), 189 deletions(-)</pre><br></html>
--- a/asterisk-15.6.2-summary.txt
+++ b/asterisk-15.6.2-summary.txt
@@ -0,0 +1,110 @@
+                                Release Summary
+
+                                asterisk-15.6.2
+
+                                Date: 2018-11-14
+
+                           <asteriskteam@digium.com>
+
+     ----------------------------------------------------------------------
+
+                               Table of Contents
+
+    1. Summary
+    2. Contributors
+    3. Closed Issues
+    4. Other Changes
+    5. Diffstat
+
+     ----------------------------------------------------------------------
+
+                                    Summary
+
+                                 [Back to Top]
+
+   This release has been made to address one or more security vulnerabilities
+   that have been identified. A security advisory document has been published
+   for each vulnerability that includes additional information. Users of
+   versions of Asterisk that are affected are strongly encouraged to review
+   the advisories and determine what action they should take to protect their
+   systems from these issues.
+
+   Security Advisories:
+
+     * AST-2018-010
+
+   The data in this summary reflects changes that have been made since the
+   previous release, asterisk-15.6.1.
+
+     ----------------------------------------------------------------------
+
+                                  Contributors
+
+                                 [Back to Top]
+
+   This table lists the people who have submitted code, those that have
+   tested patches, as well as those that reported issues on the issue tracker
+   that were resolved in this release. For coders, the number is how many of
+   their patches (of any size) were committed into this release. For testers,
+   the number is the number of times their name was listed as assisting with
+   testing a patch. Finally, for reporters, the number is the number of
+   issues that they reported that were affected by commits that went into
+   this release.
+
+   Coders                   Testers                  Reporters                
+   1 Jan Hoffmann                                    1 Jan Hoffmann           
+   1 George Joseph          
+
+     ----------------------------------------------------------------------
+
+                                 Closed Issues
+
+                                 [Back to Top]
+
+   This is a list of all issues from the issue tracker that were closed by
+   changes that went into this release.
+
+  Security
+
+    Category: Core/DNS
+
+   ASTERISK-28127: Buffer overflow for DNS SRV/NAPTR records
+   Reported by: Jan Hoffmann
+     * [ae857488d9] Jan Hoffmann -- AST-2018-010: Fix length of buffer needed
+       for SRV and NAPTR results
+
+     ----------------------------------------------------------------------
+
+                      Commits Not Associated with an Issue
+
+                                 [Back to Top]
+
+   This is a list of all changes that went into this release that did not
+   reference a JIRA issue.
+
+   +------------------------------------------------------------------------+
+   | Revision   | Author        | Summary                                   |
+   |------------+---------------+-------------------------------------------|
+   | 50bc875be6 | George Joseph | CI: Add --test-timeout option to          |
+   |            |               | runTestsuite.sh                           |
+   +------------------------------------------------------------------------+
+
+     ----------------------------------------------------------------------
+
+                                Diffstat Results
+
+                                 [Back to Top]
+
+   This is a summary of the changes to the source code that went into this
+   release that was generated using the diffstat utility.
+
+ asterisk-15.6.1-summary.html       |   26 -
+ asterisk-15.6.1-summary.txt        |  112 -----
+ b/.version                         |    2
+ b/ChangeLog                        |   44 --
+ b/asterisk-15.6.0-rc1-summary.html |  300 +++++++++++++++
+ b/asterisk-15.6.0-rc1-summary.txt  |  733 +++++++++++++++++++++++++++++++++++++
+ b/main/dns_naptr.c                 |   14
+ b/main/dns_srv.c                   |   12
+ b/tests/CI/gateTestGroups.json     |    9
+ 9 files changed, 1063 insertions(+), 189 deletions(-)
--- a/contrib/realtime/mssql/mssql_cdr.sql
+++ b/contrib/realtime/mssql/mssql_cdr.sql
@@ -0,0 +1,58 @@
+BEGIN TRANSACTION;
+
+CREATE TABLE alembic_version (
+    version_num VARCHAR(32) NOT NULL
+);
+
+GO
+
+-- Running upgrade  -> 210693f3123d
+
+CREATE TABLE cdr (
+    accountcode VARCHAR(20) NULL, 
+    src VARCHAR(80) NULL, 
+    dst VARCHAR(80) NULL, 
+    dcontext VARCHAR(80) NULL, 
+    clid VARCHAR(80) NULL, 
+    channel VARCHAR(80) NULL, 
+    dstchannel VARCHAR(80) NULL, 
+    lastapp VARCHAR(80) NULL, 
+    lastdata VARCHAR(80) NULL, 
+    start DATETIME NULL, 
+    answer DATETIME NULL, 
+    [end] DATETIME NULL, 
+    duration INTEGER NULL, 
+    billsec INTEGER NULL, 
+    disposition VARCHAR(45) NULL, 
+    amaflags VARCHAR(45) NULL, 
+    userfield VARCHAR(256) NULL, 
+    uniqueid VARCHAR(150) NULL, 
+    linkedid VARCHAR(150) NULL, 
+    peeraccount VARCHAR(20) NULL, 
+    sequence INTEGER NULL
+);
+
+GO
+
+INSERT INTO alembic_version (version_num) VALUES ('210693f3123d');
+
+GO
+
+-- Running upgrade 210693f3123d -> 54cde9847798
+
+ALTER TABLE cdr ALTER COLUMN accountcode VARCHAR(80);
+
+GO
+
+ALTER TABLE cdr ALTER COLUMN peeraccount VARCHAR(80);
+
+GO
+
+UPDATE alembic_version SET version_num='54cde9847798' WHERE alembic_version.version_num = '210693f3123d';
+
+GO
+
+COMMIT;
+
+GO
+
--- a/contrib/realtime/mssql/mssql_config.sql
+++ b/contrib/realtime/mssql/mssql_config.sql
--- a/contrib/realtime/mssql/mssql_voicemail.sql
+++ b/contrib/realtime/mssql/mssql_voicemail.sql
@@ -0,0 +1,54 @@
+BEGIN TRANSACTION;
+
+CREATE TABLE alembic_version (
+    version_num VARCHAR(32) NOT NULL
+);
+
+GO
+
+-- Running upgrade  -> a2e9769475e
+
+CREATE TABLE voicemail_messages (
+    dir VARCHAR(255) NOT NULL, 
+    msgnum INTEGER NOT NULL, 
+    context VARCHAR(80) NULL, 
+    macrocontext VARCHAR(80) NULL, 
+    callerid VARCHAR(80) NULL, 
+    origtime INTEGER NULL, 
+    duration INTEGER NULL, 
+    recording IMAGE NULL, 
+    flag VARCHAR(30) NULL, 
+    category VARCHAR(30) NULL, 
+    mailboxuser VARCHAR(30) NULL, 
+    mailboxcontext VARCHAR(30) NULL, 
+    msg_id VARCHAR(40) NULL
+);
+
+GO
+
+ALTER TABLE voicemail_messages ADD CONSTRAINT voicemail_messages_dir_msgnum PRIMARY KEY (dir, msgnum);
+
+GO
+
+CREATE INDEX voicemail_messages_dir ON voicemail_messages (dir);
+
+GO
+
+INSERT INTO alembic_version (version_num) VALUES ('a2e9769475e');
+
+GO
+
+-- Running upgrade a2e9769475e -> 39428242f7f5
+
+ALTER TABLE voicemail_messages ALTER COLUMN recording IMAGE;
+
+GO
+
+UPDATE alembic_version SET version_num='39428242f7f5' WHERE alembic_version.version_num = 'a2e9769475e';
+
+GO
+
+COMMIT;
+
+GO
+
--- a/contrib/realtime/mysql/mysql_cdr.sql
+++ b/contrib/realtime/mysql/mysql_cdr.sql
@@ -0,0 +1,40 @@
+CREATE TABLE alembic_version (
+    version_num VARCHAR(32) NOT NULL
+);
+
+-- Running upgrade  -> 210693f3123d
+
+CREATE TABLE cdr (
+    accountcode VARCHAR(20), 
+    src VARCHAR(80), 
+    dst VARCHAR(80), 
+    dcontext VARCHAR(80), 
+    clid VARCHAR(80), 
+    channel VARCHAR(80), 
+    dstchannel VARCHAR(80), 
+    lastapp VARCHAR(80), 
+    lastdata VARCHAR(80), 
+    start DATETIME, 
+    answer DATETIME, 
+    end DATETIME, 
+    duration INTEGER, 
+    billsec INTEGER, 
+    disposition VARCHAR(45), 
+    amaflags VARCHAR(45), 
+    userfield VARCHAR(256), 
+    uniqueid VARCHAR(150), 
+    linkedid VARCHAR(150), 
+    peeraccount VARCHAR(20), 
+    sequence INTEGER
+);
+
+INSERT INTO alembic_version (version_num) VALUES ('210693f3123d');
+
+-- Running upgrade 210693f3123d -> 54cde9847798
+
+ALTER TABLE cdr MODIFY accountcode VARCHAR(80) NULL;
+
+ALTER TABLE cdr MODIFY peeraccount VARCHAR(80) NULL;
+
+UPDATE alembic_version SET version_num='54cde9847798' WHERE alembic_version.version_num = '210693f3123d';
+
--- a/contrib/realtime/mysql/mysql_config.sql
+++ b/contrib/realtime/mysql/mysql_config.sql
--- a/contrib/realtime/mysql/mysql_voicemail.sql
+++ b/contrib/realtime/mysql/mysql_voicemail.sql
@@ -0,0 +1,34 @@
+CREATE TABLE alembic_version (
+    version_num VARCHAR(32) NOT NULL
+);
+
+-- Running upgrade  -> a2e9769475e
+
+CREATE TABLE voicemail_messages (
+    dir VARCHAR(255) NOT NULL, 
+    msgnum INTEGER NOT NULL, 
+    context VARCHAR(80), 
+    macrocontext VARCHAR(80), 
+    callerid VARCHAR(80), 
+    origtime INTEGER, 
+    duration INTEGER, 
+    recording BLOB, 
+    flag VARCHAR(30), 
+    category VARCHAR(30), 
+    mailboxuser VARCHAR(30), 
+    mailboxcontext VARCHAR(30), 
+    msg_id VARCHAR(40)
+);
+
+ALTER TABLE voicemail_messages ADD CONSTRAINT voicemail_messages_dir_msgnum PRIMARY KEY (dir, msgnum);
+
+CREATE INDEX voicemail_messages_dir ON voicemail_messages (dir);
+
+INSERT INTO alembic_version (version_num) VALUES ('a2e9769475e');
+
+-- Running upgrade a2e9769475e -> 39428242f7f5
+
+ALTER TABLE voicemail_messages MODIFY recording BLOB(4294967295) NULL;
+
+UPDATE alembic_version SET version_num='39428242f7f5' WHERE alembic_version.version_num = 'a2e9769475e';
+
--- a/contrib/realtime/oracle/oracle_cdr.sql
+++ b/contrib/realtime/oracle/oracle_cdr.sql
@@ -0,0 +1,52 @@
+CREATE TABLE alembic_version (
+    version_num VARCHAR2(32 CHAR) NOT NULL
+)
+
+/
+
+-- Running upgrade  -> 210693f3123d
+
+CREATE TABLE cdr (
+    accountcode VARCHAR2(20 CHAR), 
+    src VARCHAR2(80 CHAR), 
+    dst VARCHAR2(80 CHAR), 
+    dcontext VARCHAR2(80 CHAR), 
+    clid VARCHAR2(80 CHAR), 
+    channel VARCHAR2(80 CHAR), 
+    dstchannel VARCHAR2(80 CHAR), 
+    lastapp VARCHAR2(80 CHAR), 
+    lastdata VARCHAR2(80 CHAR), 
+    "start" DATE, 
+    answer DATE, 
+    end DATE, 
+    duration INTEGER, 
+    billsec INTEGER, 
+    disposition VARCHAR2(45 CHAR), 
+    amaflags VARCHAR2(45 CHAR), 
+    userfield VARCHAR2(256 CHAR), 
+    uniqueid VARCHAR2(150 CHAR), 
+    linkedid VARCHAR2(150 CHAR), 
+    peeraccount VARCHAR2(20 CHAR), 
+    sequence INTEGER
+)
+
+/
+
+INSERT INTO alembic_version (version_num) VALUES ('210693f3123d')
+
+/
+
+-- Running upgrade 210693f3123d -> 54cde9847798
+
+ALTER TABLE cdr MODIFY accountcode VARCHAR2(80 CHAR)
+
+/
+
+ALTER TABLE cdr MODIFY peeraccount VARCHAR2(80 CHAR)
+
+/
+
+UPDATE alembic_version SET version_num='54cde9847798' WHERE alembic_version.version_num = '210693f3123d'
+
+/
+
--- a/contrib/realtime/oracle/oracle_config.sql
+++ b/contrib/realtime/oracle/oracle_config.sql
--- a/contrib/realtime/oracle/oracle_voicemail.sql
+++ b/contrib/realtime/oracle/oracle_voicemail.sql
@@ -0,0 +1,48 @@
+CREATE TABLE alembic_version (
+    version_num VARCHAR2(32 CHAR) NOT NULL
+)
+
+/
+
+-- Running upgrade  -> a2e9769475e
+
+CREATE TABLE voicemail_messages (
+    dir VARCHAR2(255 CHAR) NOT NULL, 
+    msgnum INTEGER NOT NULL, 
+    context VARCHAR2(80 CHAR), 
+    macrocontext VARCHAR2(80 CHAR), 
+    callerid VARCHAR2(80 CHAR), 
+    origtime INTEGER, 
+    duration INTEGER, 
+    recording BLOB, 
+    flag VARCHAR2(30 CHAR), 
+    category VARCHAR2(30 CHAR), 
+    mailboxuser VARCHAR2(30 CHAR), 
+    mailboxcontext VARCHAR2(30 CHAR), 
+    msg_id VARCHAR2(40 CHAR)
+)
+
+/
+
+ALTER TABLE voicemail_messages ADD CONSTRAINT voicemail_messages_dir_msgnum PRIMARY KEY (dir, msgnum)
+
+/
+
+CREATE INDEX voicemail_messages_dir ON voicemail_messages (dir)
+
+/
+
+INSERT INTO alembic_version (version_num) VALUES ('a2e9769475e')
+
+/
+
+-- Running upgrade a2e9769475e -> 39428242f7f5
+
+ALTER TABLE voicemail_messages MODIFY recording BLOB
+
+/
+
+UPDATE alembic_version SET version_num='39428242f7f5' WHERE alembic_version.version_num = 'a2e9769475e'
+
+/
+
--- a/contrib/realtime/postgresql/postgresql_cdr.sql
+++ b/contrib/realtime/postgresql/postgresql_cdr.sql
@@ -0,0 +1,44 @@
+BEGIN;
+
+CREATE TABLE alembic_version (
+    version_num VARCHAR(32) NOT NULL
+);
+
+-- Running upgrade  -> 210693f3123d
+
+CREATE TABLE cdr (
+    accountcode VARCHAR(20), 
+    src VARCHAR(80), 
+    dst VARCHAR(80), 
+    dcontext VARCHAR(80), 
+    clid VARCHAR(80), 
+    channel VARCHAR(80), 
+    dstchannel VARCHAR(80), 
+    lastapp VARCHAR(80), 
+    lastdata VARCHAR(80), 
+    start TIMESTAMP WITHOUT TIME ZONE, 
+    answer TIMESTAMP WITHOUT TIME ZONE, 
+    "end" TIMESTAMP WITHOUT TIME ZONE, 
+    duration INTEGER, 
+    billsec INTEGER, 
+    disposition VARCHAR(45), 
+    amaflags VARCHAR(45), 
+    userfield VARCHAR(256), 
+    uniqueid VARCHAR(150), 
+    linkedid VARCHAR(150), 
+    peeraccount VARCHAR(20), 
+    sequence INTEGER
+);
+
+INSERT INTO alembic_version (version_num) VALUES ('210693f3123d');
+
+-- Running upgrade 210693f3123d -> 54cde9847798
+
+ALTER TABLE cdr ALTER COLUMN accountcode TYPE VARCHAR(80);
+
+ALTER TABLE cdr ALTER COLUMN peeraccount TYPE VARCHAR(80);
+
+UPDATE alembic_version SET version_num='54cde9847798' WHERE alembic_version.version_num = '210693f3123d';
+
+COMMIT;
+
--- a/contrib/realtime/postgresql/postgresql_config.sql
+++ b/contrib/realtime/postgresql/postgresql_config.sql
--- a/contrib/realtime/postgresql/postgresql_voicemail.sql
+++ b/contrib/realtime/postgresql/postgresql_voicemail.sql
@@ -0,0 +1,38 @@
+BEGIN;
+
+CREATE TABLE alembic_version (
+    version_num VARCHAR(32) NOT NULL
+);
+
+-- Running upgrade  -> a2e9769475e
+
+CREATE TABLE voicemail_messages (
+    dir VARCHAR(255) NOT NULL, 
+    msgnum INTEGER NOT NULL, 
+    context VARCHAR(80), 
+    macrocontext VARCHAR(80), 
+    callerid VARCHAR(80), 
+    origtime INTEGER, 
+    duration INTEGER, 
+    recording BYTEA, 
+    flag VARCHAR(30), 
+    category VARCHAR(30), 
+    mailboxuser VARCHAR(30), 
+    mailboxcontext VARCHAR(30), 
+    msg_id VARCHAR(40)
+);
+
+ALTER TABLE voicemail_messages ADD CONSTRAINT voicemail_messages_dir_msgnum PRIMARY KEY (dir, msgnum);
+
+CREATE INDEX voicemail_messages_dir ON voicemail_messages (dir);
+
+INSERT INTO alembic_version (version_num) VALUES ('a2e9769475e');
+
+-- Running upgrade a2e9769475e -> 39428242f7f5
+
+ALTER TABLE voicemail_messages ALTER COLUMN recording TYPE BYTEA;
+
+UPDATE alembic_version SET version_num='39428242f7f5' WHERE alembic_version.version_num = 'a2e9769475e';
+
+COMMIT;
+
--- a/main/dns_naptr.c
+++ b/main/dns_naptr.c
@@ -393,6 +393,7 @@ struct ast_dns_record *dns_naptr_alloc(struct ast_dns_query *query, const char *
 	int replacement_size;
 	const char *end_of_record;
 	enum flags_result flags_res;
+	size_t naptr_len;

 	ptr = dns_find_record(data, size, query->result->answer, query->result->answer_size);
 	ast_assert(ptr != NULL);
@@ -435,7 +436,14 @@ struct ast_dns_record *dns_naptr_alloc(struct ast_dns_query *query, const char *
 		return NULL;
 	}

-	replacement_size = dn_expand((unsigned char *)query->result->answer, (unsigned char *) end_of_record, (unsigned char *) ptr, replacement, sizeof(replacement) - 1);
+	/*
+	 * The return value from dn_expand represents the size of the replacement
+	 * in the buffer which MAY be compressed.  Since the expanded replacement
+	 * is NULL terminated, you can use strlen() to get the expanded size.
+	 */
+	replacement_size = dn_expand((unsigned char *)query->result->answer,
+		(unsigned char *) end_of_record, (unsigned char *) ptr,
+		replacement, sizeof(replacement) - 1);
 	if (replacement_size < 0) {
 		ast_log(LOG_ERROR, "Failed to expand domain name: %s\n", strerror(errno));
 		return NULL;
@@ -475,7 +483,9 @@ struct ast_dns_record *dns_naptr_alloc(struct ast_dns_query *query, const char *
 		return NULL;
 	}

-	naptr = ast_calloc(1, sizeof(*naptr) + size + flags_size + 1 + services_size + 1 + regexp_size + 1 + replacement_size + 1);
+	naptr_len = sizeof(*naptr) + size + flags_size + 1 + services_size + 1
+		+ regexp_size + 1 + strlen(replacement) + 1;
+	naptr = ast_calloc(1, naptr_len);
 	if (!naptr) {
 		return NULL;
 	}
--- a/main/dns_srv.c
+++ b/main/dns_srv.c
@@ -73,7 +73,13 @@ struct ast_dns_record *dns_srv_alloc(struct ast_dns_query *query, const char *da
 		return NULL;
 	}

-	host_size = dn_expand((unsigned char *)query->result->answer, (unsigned char *) end_of_record, (unsigned char *) ptr, host, sizeof(host) - 1);
+	/*
+	 * The return value from dn_expand represents the size of the replacement
+	 * in the buffer which MAY be compressed.  Since the expanded replacement
+	 * is NULL terminated, you can use strlen() to get the expanded size.
+	 */
+	host_size = dn_expand((unsigned char *)query->result->answer,
+		(unsigned char *) end_of_record, (unsigned char *) ptr, host, sizeof(host) - 1);
 	if (host_size < 0) {
 		ast_log(LOG_ERROR, "Failed to expand domain name: %s\n", strerror(errno));
 		return NULL;
@@ -83,7 +89,7 @@ struct ast_dns_record *dns_srv_alloc(struct ast_dns_query *query, const char *da
 		return NULL;
 	}

-	srv = ast_calloc(1, sizeof(*srv) + size + host_size + 1);
+	srv = ast_calloc(1, sizeof(*srv) + size + strlen(host) + 1);
 	if (!srv) {
 		return NULL;
 	}
@@ -94,8 +100,6 @@ struct ast_dns_record *dns_srv_alloc(struct ast_dns_query *query, const char *da

 	srv->host = srv->data + size;
 	strcpy((char *)srv->host, host); /* SAFE */
-	((char *)srv->host)[host_size] = '\0';
-
 	srv->generic.data_ptr = srv->data;

 	return (struct ast_dns_record *)srv;
--- a/res/res_http_websocket.c
+++ b/res/res_http_websocket.c
@@ -758,7 +758,8 @@ static void websocket_bad_request(struct ast_tcptls_session_instance *ser)
 int AST_OPTIONAL_API_NAME(ast_websocket_uri_cb)(struct ast_tcptls_session_instance *ser, const struct ast_http_uri *urih, const char *uri, enum ast_http_method method, struct ast_variable *get_vars, struct ast_variable *headers)
 {
 	struct ast_variable *v;
-	char *upgrade = NULL, *key = NULL, *key1 = NULL, *key2 = NULL, *protos = NULL, *requested_protocols = NULL, *protocol = NULL;
+	const char *upgrade = NULL, *key = NULL, *key1 = NULL, *key2 = NULL, *protos = NULL;
+	char *requested_protocols = NULL, *protocol = NULL;
 	int version = 0, flags = 1;
 	struct ast_websocket_protocol *protocol_handler = NULL;
 	struct ast_websocket *session;
@@ -777,16 +778,15 @@ int AST_OPTIONAL_API_NAME(ast_websocket_uri_cb)(struct ast_tcptls_session_instan
 	/* Get the minimum headers required to satisfy our needs */
 	for (v = headers; v; v = v->next) {
 		if (!strcasecmp(v->name, "Upgrade")) {
-			upgrade = ast_strip(ast_strdupa(v->value));
+			upgrade = v->value;
 		} else if (!strcasecmp(v->name, "Sec-WebSocket-Key")) {
-			key = ast_strip(ast_strdupa(v->value));
+			key = v->value;
 		} else if (!strcasecmp(v->name, "Sec-WebSocket-Key1")) {
-			key1 = ast_strip(ast_strdupa(v->value));
+			key1 = v->value;
 		} else if (!strcasecmp(v->name, "Sec-WebSocket-Key2")) {
-			key2 = ast_strip(ast_strdupa(v->value));
+			key2 = v->value;
 		} else if (!strcasecmp(v->name, "Sec-WebSocket-Protocol")) {
-			requested_protocols = ast_strip(ast_strdupa(v->value));
-			protos = ast_strdupa(requested_protocols);
+			protos = v->value;
 		} else if (!strcasecmp(v->name, "Sec-WebSocket-Version")) {
 			if (sscanf(v->value, "%30d", &version) != 1) {
 				version = 0;
@@ -800,7 +800,7 @@ int AST_OPTIONAL_API_NAME(ast_websocket_uri_cb)(struct ast_tcptls_session_instan
 			ast_sockaddr_stringify(&ser->remote_address));
 		ast_http_error(ser, 426, "Upgrade Required", NULL);
 		return 0;
-	} else if (ast_strlen_zero(requested_protocols)) {
+	} else if (ast_strlen_zero(protos)) {
 		/* If there's only a single protocol registered, and the
 		 * client doesn't specify what protocol it's using, go ahead
 		 * and accept the connection */
@@ -821,9 +821,12 @@ int AST_OPTIONAL_API_NAME(ast_websocket_uri_cb)(struct ast_tcptls_session_instan
 		return 0;
 	}

-	/* Iterate through the requested protocols trying to find one that we have a handler for */
-	while (!protocol_handler && (protocol = strsep(&requested_protocols, ","))) {
-		protocol_handler = ao2_find(server->protocols, ast_strip(protocol), OBJ_KEY);
+	if (!protocol_handler && protos) {
+		requested_protocols = ast_strdupa(protos);
+		/* Iterate through the requested protocols trying to find one that we have a handler for */
+		while (!protocol_handler && (protocol = strsep(&requested_protocols, ","))) {
+			protocol_handler = ao2_find(server->protocols, ast_strip(protocol), OBJ_KEY);
+		}
 	}

 	/* If no protocol handler exists bump this back to the requester */
--- a/tests/CI/gateTestGroups.json
+++ b/tests/CI/gateTestGroups.json
@@ -2,46 +2,55 @@
 	{
 		"name": "ari1",
 		"dir": "tests/CI/output/ari1",
+		"runTestsuiteOptions": "--test-timeout=180",
 		"testcmd": "--test-regex=tests/rest_api/[Ca-d]"
 	},
 	{
 		"name": "ari2",
 		"dir": "tests/CI/output/ari2",
+		"runTestsuiteOptions": "--test-timeout=180",
 		"testcmd": "--test-regex=tests/rest_api/[e-z]"
 	},
 	{
 		"name": "pjs1",
 		"dir": "tests/CI/output/pjsip1",
+		"runTestsuiteOptions": "--test-timeout=180",
 		"testcmd": "--test-regex=tests/channels/pjsip/[a-f]"
 	},
 	{
 		"name": "pjs2",
 		"dir": "tests/CI/output/pjsip2",
+		"runTestsuiteOptions": "--test-timeout=180",
 		"testcmd": "--test-regex=tests/channels/pjsip/[g-r]"
 	},
 	{
 		"name": "pjs3",
 		"dir": "tests/CI/output/pjsip3",
+		"runTestsuiteOptions": "--test-timeout=180",
 		"testcmd": "--test-regex=tests/channels/pjsip/[s-z]"
 	},
 	{
 		"name": "sip1",
 		"dir": "tests/CI/output/sip1",
+		"runTestsuiteOptions": "--test-timeout=240",
 		"testcmd": "--test-regex=tests/channels/SIP/[Sa-r]"
 	},
 	{
 		"name": "sip2",
 		"dir": "tests/CI/output/sip2",
+		"runTestsuiteOptions": "--test-timeout=240",
 		"testcmd": "--test-regex=tests/channels/SIP/[s-z]"
 	},
 	{
 		"name": "iax ",
 		"dir": "tests/CI/output/iax2_local",
+		"runTestsuiteOptions": "--test-timeout=180",
 		"testcmd": " -t tests/channels/iax2 -t tests/channels/local"
 	},
 	{
 		"name": "mwi ",
 		"dir": "tests/CI/output/extmwi",
+		"runTestsuiteOptions": "--test-timeout=180",
 		"testcmd": "--test-regex=tests/channels/pjsip/.*mwi"
 	}
 ]
--- a/tests/CI/gates.jenkinsfile
+++ b/tests/CI/gates.jenkinsfile
@@ -170,8 +170,10 @@ pipeline {

 									sh "sudo rm -rf ${groupDir} || : "
 									
-									checkout scm: [$class: 'GitSCM',
-										branches: [[name: "${BRANCH_NAME}"]],
+									withCredentials([usernamePassword(credentialsId: "${JENKINS_GERRIT_CREDS}",
+										passwordVariable: 'GERRIT_USER_PW', usernameVariable: 'GERRIT_USER_NAME')]) {
+										checkout scm: [$class: 'GitSCM',
+											branches: [[name: "${BRANCH_NAME}"]],
 											extensions: [
 												[$class: 'RelativeTargetDirectory', relativeTargetDir: groupDir],
 												[$class: 'CloneOption',
@@ -181,8 +183,15 @@ pipeline {
 													shallow: true
 												],
 											],
-											userRemoteConfigs: [[name: env.GERRIT_NAME, url: testsuiteUrl]]
+											userRemoteConfigs: [
+												[
+												credentialsId: env.JENKINS_GERRIT_CREDS,
+												name: env.GERRIT_NAME,
+												url: testsuiteUrl.replaceAll("http(s)?://", "http\$1://${GERRIT_USER_NAME}@")
+												]
+											]
 										]
+									}

 									sh "sudo tests/CI/runTestsuite.sh --testsuite-dir='${groupDir}' --testsuite-command='${groupTestcmd}'"

--- a/tests/CI/periodic-dailyTestGroups.json
+++ b/tests/CI/periodic-dailyTestGroups.json
@@ -2,37 +2,43 @@
 	{
 		"name": "ari ",
 		"dir": "tests/CI/output/ari",
+		"runTestsuiteOptions": "--test-timeout=180",
 		"testcmd": "-t tests/rest_api/"
 	},
 	{
 		"name": "pjs ",
 		"dir": "tests/CI/output/pjsip",
+		"runTestsuiteOptions": "--test-timeout=180",
 		"testcmd": "-t tests/channels/pjsip"
 	},
 	{
 		"name": "sip ",
 		"dir": "tests/CI/output/sip",
+		"runTestsuiteOptions": "--test-timeout=240",
 		"testcmd": "-t tests/channels/SIP"
 	},
 	{
 		"name": "iax ",
 		"dir": "tests/CI/output/iax2_local",
+		"runTestsuiteOptions": "--test-timeout=180",
 		"testcmd": " -t tests/channels/iax2 -t tests/channels/local"
 	},
 	{
 		"name": "apps",
 		"dir": "tests/CI/output/agi-apps",
+		"runTestsuiteOptions": "--test-timeout=180",
 		"testcmd": " -t tests/agi -t tests/apps -t blind-transfer-parkingtimeout"
 	},
 	{
 		"name": "othr",
 		"dir": "tests/CI/output/other",
+		"runTestsuiteOptions": "--test-timeout=180",
 		"testcmd": " -T tests/(apps|agi|blind-transfer-parkingtimeout|rest_api|channels|realtime|example|skeleton_test|remote-test)"
 	},
 	{
 		"name": "real",
 		"dir": "tests/CI/output/realtime",
-		"runTestsuiteOptions": "--realtime --initialize-db --cleanup-db",
+		"runTestsuiteOptions": "--test-timeout=180 --realtime --initialize-db --cleanup-db",
 		"testcmd": " -t tests/channels/pjsip -G realtime-incompatible"
 	}
 ]
--- a/tests/CI/runTestsuite.sh
+++ b/tests/CI/runTestsuite.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 CIDIR=$(dirname $(readlink -fn $0))
 REALTIME=0
+TEST_TIMEOUT=600
 source $CIDIR/ci.functions
 ASTETCDIR=$DESTDIR/etc/asterisk

@@ -14,7 +15,7 @@ fi

 export PYTHONPATH=./lib/python/
 echo "Running tests ${TESTSUITE_COMMAND}"
-./runtests.py --cleanup ${TESTSUITE_COMMAND} | contrib/scripts/pretty_print --no-color --no-timer --term-width=120 --show-errors || :
+./runtests.py --cleanup --timeout=${TEST_TIMEOUT} ${TESTSUITE_COMMAND} | contrib/scripts/pretty_print --no-color --no-timer --term-width=120 --show-errors || :

 if [ $REALTIME -eq 1 ] ; then
 	$CIDIR/teardownRealtime.sh --cleanup-db=${CLEANUP_DB:?0}
Author	SHA1	Message	Date
George Joseph	ae4cd1d88b	Update for 15.6.2	2018-11-14 10:33:38 -06:00
George Joseph	ae857488d9	AST-2018-010: Fix length of buffer needed for SRV and NAPTR results When dn_expand was being called on SRV and NAPTR results, the return value was being used to calculate the size of the buffer needed to store the host names. Since dn_expand returns the length of the COMPRESSED name the buffer could be too short to hold the EXPANDED name. The expanded name is NULL terminated so using strlen() is the correct way to determine the length actually needed for the buffer. ASTERISK-28127 Reported by: Jan Hoffmann patches: patch.diff submitted by janhoffmann (license 6986) Change-Id: I4d35d6c431c6c6836cb61d37b1378cc47f0b414d	2018-11-14 09:26:12 -05:00
George Joseph	50bc875be6	CI: Add --test-timeout option to runTestsuite.sh The default is 600 seconds. Also added timeouts to the *TestGroups.json files. Change-Id: I8ab6a69e704b6a10f06a0e52ede02312a2b72fe0	2018-09-26 08:14:53 -05:00
Sean Bright	7d964e4b2e	AST-2018-009: Fix crash processing websocket HTTP Upgrade requests The HTTP request processing in res_http_websocket allocates additional space on the stack for various headers received during an Upgrade request. An attacker could send a specially crafted request that causes this code to overflow the stack, resulting in a crash. * No longer allocate memory from the stack in a loop to parse the header values. NOTE: There is a slight API change when using the passed in strings as is. We now require the passed in strings to no longer have leading or trailing whitespace. This isn't a problem as the only callers have already done this before passing the strings to the affected function. ASTERISK-28013 #close Change-Id: Ia564825a8a95e085fd17e658cb777fe1afa8091a	2018-09-20 11:19:51 -05:00
George Joseph	c3df800620	CI: Fix typo in testsuite git checkout Change-Id: I30024515e5b00a5044fd39fbff27d818f016b719 (cherry picked from commit `cb19ca981d`)	2018-09-17 07:29:12 -05:00
George Joseph	a914214af4	CI: Use proper credentials for Security testsuite checkout Can't do anonymous http checkout from Security-testsuite. Need to use same credentials as the gerrit review checkout. Change-Id: I87af68c995cb8926f5e87f9af245600d76984f05	2018-09-14 12:34:43 -05:00
Kevin Harwell	4465ac3623	Update for 15.6.0-rc1	2018-08-28 14:19:14 -05:00