From fb768ec33a27cc9de76ee7e95ef9f08e0948b47b Mon Sep 17 00:00:00 2001 From: Joshua Colp Date: Wed, 10 Dec 2014 13:34:05 +0000 Subject: res_http_websocket: Fix crash due to double freeing memory when receiving a payload length of zero. Frames with a payload length of 0 were incorrectly handled in res_http_websocket. Provided a frame with a payload had been received prior it was possible for a double free to occur. The realloc operation would succeed (thus freeing the payload) but be treated as an error. When the session was then torn down the payload would be freed again causing a crash. The read function now takes this into account. This change also fixes assumptions made by users of res_http_websocket. There is no guarantee that a frame received from it will be NULL terminated. ASTERISK-24472 #close Reported by: Badalian Vyacheslav Review: https://reviewboard.asterisk.org/r/4220/ Review: https://reviewboard.asterisk.org/r/4219/ ........ Merged revisions 429270 from http://svn.asterisk.org/svn/asterisk/branches/11 ........ Merged revisions 429272 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/13@429273 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- channels/chan_sip.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'channels/chan_sip.c') diff --git a/channels/chan_sip.c b/channels/chan_sip.c index ee55fd38d..d961730c7 100644 --- a/channels/chan_sip.c +++ b/channels/chan_sip.c @@ -2644,12 +2644,16 @@ static void sip_websocket_callback(struct ast_websocket *session, struct ast_var if (opcode == AST_WEBSOCKET_OPCODE_TEXT || opcode == AST_WEBSOCKET_OPCODE_BINARY) { struct sip_request req = { 0, }; + char data[payload_len + 1]; if (!(req.data = ast_str_create(payload_len + 1))) { goto end; } - if (ast_str_set(&req.data, -1, "%s", payload) == AST_DYNSTR_BUILD_FAILED) { + strncpy(data, payload, payload_len); + data[payload_len] = '\0'; + + if (ast_str_set(&req.data, -1, "%s", data) == AST_DYNSTR_BUILD_FAILED) { deinit_req(&req); goto end; } -- cgit v1.2.3