net/asterisk-13.x/patches/070-AST-2018-009-13.diff

   1 From e6b0c4d27e0392a7b4b4b6717a6d1e0ea049b550 Mon Sep 17 00:00:00 2001
   2 From: Sean Bright <sean.bright@gmail.com>
   3 Date: Thu, 16 Aug 2018 11:45:53 -0400
   4 Subject: [PATCH] AST-2018-009: Fix crash processing websocket HTTP Upgrade
   5  requests
   6
   7 The HTTP request processing in res_http_websocket allocates additional
   8 space on the stack for various headers received during an Upgrade request.
   9 An attacker could send a specially crafted request that causes this code
  10 to overflow the stack, resulting in a crash.
  11
  12 * No longer allocate memory from the stack in a loop to parse the header
  13 values.  NOTE: There is a slight API change when using the passed in
  14 strings as is.  We now require the passed in strings to no longer have
  15 leading or trailing whitespace.  This isn't a problem as the only callers
  16 have already done this before passing the strings to the affected
  17 function.
  18
  19 ASTERISK-28013 #close
  20
  21 Change-Id: Ia564825a8a95e085fd17e658cb777fe1afa8091a
  22 ---
  23  res/res_http_websocket.c | 25 ++++++++++++++-----------
  24  1 file changed, 14 insertions(+), 11 deletions(-)
  25
  26 diff --git a/res/res_http_websocket.c b/res/res_http_websocket.c
  27 index 440bf41..0ff876b 100644
  28 --- a/res/res_http_websocket.c
  29 +++ b/res/res_http_websocket.c
  30 @@ -736,7 +736,8 @@ static void websocket_bad_request(struct ast_tcptls_session_instance *ser)
  31  int AST_OPTIONAL_API_NAME(ast_websocket_uri_cb)(struct ast_tcptls_session_instance *ser, const struct ast_http_uri *urih, const char *uri, enum ast_http_method method, struct ast_variable *get_vars, struct ast_variable *headers)
  32  {
  33         struct ast_variable *v;
  34 -       char *upgrade = NULL, *key = NULL, *key1 = NULL, *key2 = NULL, *protos = NULL, *requested_protocols = NULL, *protocol = NULL;
  35 +       const char *upgrade = NULL, *key = NULL, *key1 = NULL, *key2 = NULL, *protos = NULL;
  36 +       char *requested_protocols = NULL, *protocol = NULL;
  37         int version = 0, flags = 1;
  38         struct ast_websocket_protocol *protocol_handler = NULL;
  39         struct ast_websocket *session;
  40 @@ -755,16 +756,15 @@ int AST_OPTIONAL_API_NAME(ast_websocket_uri_cb)(struct ast_tcptls_session_instan
  41         /* Get the minimum headers required to satisfy our needs */
  42         for (v = headers; v; v = v->next) {
  43                 if (!strcasecmp(v->name, "Upgrade")) {
  44 -                       upgrade = ast_strip(ast_strdupa(v->value));
  45 +                       upgrade = v->value;
  46                 } else if (!strcasecmp(v->name, "Sec-WebSocket-Key")) {
  47 -                       key = ast_strip(ast_strdupa(v->value));
  48 +                       key = v->value;
  49                 } else if (!strcasecmp(v->name, "Sec-WebSocket-Key1")) {
  50 -                       key1 = ast_strip(ast_strdupa(v->value));
  51 +                       key1 = v->value;
  52                 } else if (!strcasecmp(v->name, "Sec-WebSocket-Key2")) {
  53 -                       key2 = ast_strip(ast_strdupa(v->value));
  54 +                       key2 = v->value;
  55                 } else if (!strcasecmp(v->name, "Sec-WebSocket-Protocol")) {
  56 -                       requested_protocols = ast_strip(ast_strdupa(v->value));
  57 -                       protos = ast_strdupa(requested_protocols);
  58 +                       protos = v->value;
  59                 } else if (!strcasecmp(v->name, "Sec-WebSocket-Version")) {
  60                         if (sscanf(v->value, "%30d", &version) != 1) {
  61                                 version = 0;
  62 @@ -778,7 +778,7 @@ int AST_OPTIONAL_API_NAME(ast_websocket_uri_cb)(struct ast_tcptls_session_instan
  63                         ast_sockaddr_stringify(&ser->remote_address));
  64                 ast_http_error(ser, 426, "Upgrade Required", NULL);
  65                 return 0;
  66 -       } else if (ast_strlen_zero(requested_protocols)) {
  67 +       } else if (ast_strlen_zero(protos)) {
  68                 /* If there's only a single protocol registered, and the
  69                  * client doesn't specify what protocol it's using, go ahead
  70                  * and accept the connection */
  71 @@ -799,9 +799,12 @@ int AST_OPTIONAL_API_NAME(ast_websocket_uri_cb)(struct ast_tcptls_session_instan
  72                 return 0;
  73         }
  74
  75 -       /* Iterate through the requested protocols trying to find one that we have a handler for */
  76 -       while (!protocol_handler && (protocol = strsep(&requested_protocols, ","))) {
  77 -               protocol_handler = ao2_find(server->protocols, ast_strip(protocol), OBJ_KEY);
  78 +       if (!protocol_handler && protos) {
  79 +               requested_protocols = ast_strdupa(protos);
  80 +               /* Iterate through the requested protocols trying to find one that we have a handler for */
  81 +               while (!protocol_handler && (protocol = strsep(&requested_protocols, ","))) {
  82 +                       protocol_handler = ao2_find(server->protocols, ast_strip(protocol), OBJ_KEY);
  83 +               }
  84         }
  85
  86         /* If no protocol handler exists bump this back to the requester */
  87 --
  88 2.7.4
  89