kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2026-07-10 16:32:39 -07:00
Code Issues Packages Projects Releases Wiki Activity

ooh323c: not checking for IE minimum length

Browse Source 
When decoding q.931 encoded calling/called number
now checking for length being less than minimum required.

Resolves: #GHSA-h5hv-jmgj-92q2
This commit is contained in:
Mike Bradeen
2022-06-06 17:11:30 -06:00
committed by George Joseph
parent c10cdbce07
commit 07b9740cbc
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/ooh323c/src/ooq931.c
+9 -6
View File
@@ -226,11 +226,13 @@ EXTERN int ooQ931Decode
screening indicators ;-) */
if(ie->discriminator == Q931CallingPartyNumberIE)
{
int numoffset=1;
OOTRACEDBGB1(" CallingPartyNumber IE = {\n");
if(ie->length < OO_MAX_NUMBER_LENGTH)
if(!(0x80 & ie->data[0])) numoffset = 2;
if( (ie->length >= numoffset) &&
(ie->length < OO_MAX_NUMBER_LENGTH) )
{
int numoffset=1;
if(!(0x80 & ie->data[0])) numoffset = 2;
memcpy(number, ie->data+numoffset,ie->length-numoffset);
number[ie->length-numoffset]='\0';
OOTRACEDBGB2(" %s\n", number);
@@ -238,7 +240,7 @@ EXTERN int ooQ931Decode
ooCallSetCallingPartyNumber(call, number);
}
else{
OOTRACEERR3("Error:Calling party number too long. (%s, %s)\n",
OOTRACEERR3("Error:Calling party number outside range. (%s, %s)\n",
call->callType, call->callToken);
}
OOTRACEDBGB1(" }\n");
@@ -248,7 +250,8 @@ EXTERN int ooQ931Decode
if(ie->discriminator == Q931CalledPartyNumberIE)
{
OOTRACEDBGB1(" CalledPartyNumber IE = {\n");
if(ie->length < OO_MAX_NUMBER_LENGTH)
if( (ie->length >= 1) &&
(ie->length < OO_MAX_NUMBER_LENGTH) )
{
memcpy(number, ie->data+1,ie->length-1);
number[ie->length-1]='\0';
@@ -257,7 +260,7 @@ EXTERN int ooQ931Decode
ooCallSetCalledPartyNumber(call, number);
}
else{
OOTRACEERR3("Error:Calling party number too long. (%s, %s)\n",
OOTRACEERR3("Error:Calling party number outside range. (%s, %s)\n",
call->callType, call->callToken);
}
OOTRACEDBGB1(" }\n");