diff options
| author | russell <russell@f38db490-d61c-443f-a65b-d21fe96a405b> | 2006-06-05 22:03:16 +0000 |
|---|---|---|
| committer | russell <russell@f38db490-d61c-443f-a65b-d21fe96a405b> | 2006-06-05 22:03:16 +0000 |
| commit | 1ed085172c57d4fa66467cae4c4b603cfe7bdc41 (patch) | |
| tree | 1dc4046a41de2e269b4aa2fddbb32d8d7429815c /channels | |
| parent | 295911c6df2fa0db4df85dea8c07ededdcc0196d (diff) | |
backport the chan_iax2 security fix from 1.2 and trunk ...
ensure that the received number of bytes is included in all IAX2 incoming
frame analysis checks (fixes a known vulnerability)
git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.0@32428 f38db490-d61c-443f-a65b-d21fe96a405b
Diffstat (limited to 'channels')
| -rw-r--r-- | channels/chan_iax2.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/channels/chan_iax2.c b/channels/chan_iax2.c index b1756efb3..d55734293 100644 --- a/channels/chan_iax2.c +++ b/channels/chan_iax2.c @@ -5052,11 +5052,11 @@ static int socket_read(int *id, int fd, short events, void *cbdata) ast_log(LOG_WARNING, "midget packet received (%d of %d min)\n", res, (int)sizeof(struct ast_iax2_mini_hdr)); return 1; } - if ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000)) { + if ((res >= sizeof(*vh)) && ((vh->zeros == 0) && (ntohs(vh->callno) & 0x8000))) { /* This is a video frame, get call number */ fr.callno = find_callno(ntohs(vh->callno) & ~0x8000, dcallno, &sin, new, 1); minivid = 1; - } else if (meta->zeros == 0) { + } else if ((res >= sizeof(*meta)) && (meta->zeros == 0) && !(ntohs(meta->metacmd) & 0x8000)) { /* This is a meta header */ switch(meta->metacmd) { case IAX_META_TRUNK: @@ -5149,11 +5149,19 @@ static int socket_read(int *id, int fd, short events, void *cbdata) } return 1; } + /* if we got here and ->zeros contains zeros, this cannot be a valid + miniframe or full frame but it wasn't a valid video frame or meta + frame either, so we reject it + */ + if (vh->zeros == 0) { + ast_log(LOG_WARNING, "Rejecting packet from '%s.%d' that is flagged as a video or meta frame but is not properly formatted\n", ast_inet_ntoa(iabuf, sizeof(iabuf), sin.sin_addr), ntohs(sin.sin_port)); + return 1; + } #ifdef DEBUG_SUPPORT if (iaxdebug) iax_showframe(NULL, fh, 1, &sin, res - sizeof(struct ast_iax2_full_hdr)); #endif - if (ntohs(mh->callno) & IAX_FLAG_FULL) { + if ((res >= sizeof(*fh)) && ntohs(mh->callno) & IAX_FLAG_FULL) { /* Get the destination call number */ dcallno = ntohs(fh->dcallno) & ~IAX_FLAG_RETRANS; /* Retrieve the type and subclass */ |