[Home]

Summary:ASTERISK-28449: scheduler: Supported time can be exceeded by PUBLISH
Reporter:Gil Richard (GilRichard)Labels:
Date Opened:2019-06-13 10:26:05Date Closed:
Priority:MinorRegression?
Status:Open/NewComponents:Core/Platform Resources/res_pjsip_pubsub
Versions:16.3.0 Frequency of
Occurrence
Related
Issues:
is duplicated byASTERISK-29987 Integer Overflow in Asterisk Scheduler
Environment:Attachments:
Description:The scheduler (main/sched.c) uses a signed integer value for setting timers in milliseconds.  The SIP RFC [3261 20.19] specifies an Expiry as being between 0 and (2**32)-1.  When converted to ms, the maximum value exceeds the bounds of a signed integer and becomes a negative value.

This can replicated by issuing a PUBLISH with an Expiry of 4294967295.  sched_settime() will complain about a negative time and assert 0.

Changing to an unsigned int or an unsigned long int will likely remedy the issue.
Comments:By: Asterisk Team (asteriskteam) 2019-06-13 10:26:06.086-0500

Thanks for creating a report! The issue has entered the triage process. That means the issue will wait in this status until a Bug Marshal has an opportunity to review the issue. Once the issue has been reviewed you will receive comments regarding the next steps towards resolution.

A good first step is for you to review the [Asterisk Issue Guidelines|https://wiki.asterisk.org/wiki/display/AST/Asterisk+Issue+Guidelines] if you haven't already. The guidelines detail what is expected from an Asterisk issue report.

Then, if you are submitting a patch, please review the [Patch Contribution Process|https://wiki.asterisk.org/wiki/display/AST/Patch+Contribution+Process].

Please note that once your issue enters an open state it has been accepted. As Asterisk is an open source project there is no guarantee or timeframe on when your issue will be looked into. If you need expedient resolution you will need to find and pay a suitable developer. Asking for an update on your issue will not yield any progress on it and will not result in a response. All updates are posted to the issue when they occur.

By: Gil Richard (GilRichard) 2019-06-18 13:39:23.157-0500

PJSIP also stores the Expiry in a signed integer (*pjsip_expires_hdr* is defined as a *pjsip_generic_int_hdr*, which is itself defined as *pj_int32_t*).  pjlib's expiry storage will also need to be expanded.

By: Gil Richard (GilRichard) 2019-06-20 10:50:23.529-0500

A PR has been issued in the pjproject github page to address the issue:

https://github.com/pjsip/pjproject/pull/12

By: Ross Beer (rossbeer) 2019-07-01 05:09:25.615-0500

Looks like this has been corrected in PJPROJECT:

https://trac.pjsip.org/repos/changeset/6035

By: Gil Richard (GilRichard) 2019-07-02 08:00:02.459-0500

Great news!  Thanks for the update.