Asterisk
  1. Asterisk
  2. ASTERISK-29227

res_pjsip_diversion: sending multiple 181 responses causes memory corruption and crash

    Details

    • Regression:
      No
    • PJSIP Bundled:
      Yes

      Description

      Every time Asterisk/chan_pjsip transmits a "181 Call is being forwarded" packet, res_pjsip_diversion adds a "histinfo" element to Supported header. It doesn't check if "histinfo" has already been added, nor it performs a bounds check, thus making it possible to overwrite/corrupt memory past the PJSIP_GENERIC_ARRAY_MAX_COUNT elements that pjsip_supported_hdr can contain.

      How to reproduce

      Make a call from a pjsip endpoint to this diaplan:

      exten => 181,1,NoOp
      same => n,Set(i=9000)
      same => n,While($[ ${DEC(i)} != 0])
      same => n,Set(REDIRECTING(from-num)=${i})
      same => n,EndWhile

      How to crash Asterisk remotely

      Use Dial application on an unanswered incoming PJSIP channel to connect to a channel indicating AST_CONTROL_REDIRECTING more than PJSIP_GENERIC_ARRAY_MAX_COUNT times (32 by default).
      Example:

      • 2 PJSIP endpoints [alice] and [bob]
      • PJSIP/alice-00000001 executes Dial(PJSIP/bob)
      • PJSIP/bob-00000002 sends an INVITE to bob
      • bob sends 100 Trying, followed by repeating "181 Call Is Being Forwarded"
      • Asterisk transmits 181 Call Is Being Forwarded to alice, adding one more "histinfo" element to Supported, eventually overwriting memory past array boundary until Asterisk crashes.

        Issue Links

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

          Hide
          Friendly Automation added a comment -

          Change 15466 merged by George Joseph:
          res_pjsip_diversion: Fix adding more than one histinfo to Supported

          https://gerrit.asterisk.org/c/asterisk/+/15466

          Show
          Friendly Automation added a comment - Change 15466 merged by George Joseph: res_pjsip_diversion: Fix adding more than one histinfo to Supported https://gerrit.asterisk.org/c/asterisk/+/15466
          Hide
          Friendly Automation added a comment -

          Change 15463 merged by George Joseph:
          res_pjsip_diversion: Fix adding more than one histinfo to Supported

          https://gerrit.asterisk.org/c/asterisk/+/15463

          Show
          Friendly Automation added a comment - Change 15463 merged by George Joseph: res_pjsip_diversion: Fix adding more than one histinfo to Supported https://gerrit.asterisk.org/c/asterisk/+/15463
          Hide
          Friendly Automation added a comment -

          Change 15454 merged by George Joseph:
          res_pjsip_diversion: Fix adding more than one histinfo to Supported

          https://gerrit.asterisk.org/c/asterisk/+/15454

          Show
          Friendly Automation added a comment - Change 15454 merged by George Joseph: res_pjsip_diversion: Fix adding more than one histinfo to Supported https://gerrit.asterisk.org/c/asterisk/+/15454
          Hide
          Friendly Automation added a comment -

          Change 15453 merged by George Joseph:
          res_pjsip_diversion: Fix adding more than one histinfo to Supported

          https://gerrit.asterisk.org/c/asterisk/+/15453

          Show
          Friendly Automation added a comment - Change 15453 merged by George Joseph: res_pjsip_diversion: Fix adding more than one histinfo to Supported https://gerrit.asterisk.org/c/asterisk/+/15453
          Hide
          Friendly Automation added a comment -

          Change 15451 merged by George Joseph:
          res_pjsip_diversion: Fix adding more than one histinfo to Supported

          https://gerrit.asterisk.org/c/asterisk/+/15451

          Show
          Friendly Automation added a comment - Change 15451 merged by George Joseph: res_pjsip_diversion: Fix adding more than one histinfo to Supported https://gerrit.asterisk.org/c/asterisk/+/15451

            People

            • Watchers:
              4 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: