kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2026-07-27 16:07:15 -07:00
Code Issues Packages Projects Releases Wiki Activity

Fix some very broken code that was introduced in 1.2.26 as a part of the security

Browse Source 
fix.  The dnsmgr is not appropriate here.  The dnsmgr takes a pointer to an address
structure that a background thread continuously updates.  However, in these cases,
a stack variable was passed.  That means that the dnsmgr thread would be continuously
writing to bogus memory.


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.2@110335 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Russell Bryant
2008-03-20 21:53:27 +00:00
parent 53ca368854
commit 62766834c8
2 changed files with 9 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
channels/chan_iax2.c
+6 -6
View File
@@ -2657,9 +2657,9 @@ static struct iax2_peer *realtime_peer(const char *peername, struct sockaddr_in
if (var && sin) {
for (tmp = var; tmp; tmp = tmp->next) {
if (!strcasecmp(tmp->name, "host")) {
struct in_addr sin2 = { 0, };
struct ast_dnsmgr_entry *dnsmgr = NULL;
if ((ast_dnsmgr_lookup(tmp->value, &sin2, &dnsmgr) < 0) || (memcmp(&sin2, &sin->sin_addr, sizeof(sin2)) != 0)) {
struct ast_hostent ahp;
struct hostent *hp;
if (!(hp = ast_gethostbyname(tmp->value, &ahp)) || (memcmp(&hp->h_addr, &sin->sin_addr, sizeof(hp->h_addr)))) {
/* No match */
ast_variables_destroy(var);
var = NULL;
@@ -2773,9 +2773,9 @@ static struct iax2_user *realtime_user(const char *username, struct sockaddr_in
if (var) {
for (tmp = var; tmp; tmp = tmp->next) {
if (!strcasecmp(tmp->name, "host")) {
struct in_addr sin2 = { 0, };
struct ast_dnsmgr_entry *dnsmgr = NULL;
if ((ast_dnsmgr_lookup(tmp->value, &sin2, &dnsmgr) < 0) || (memcmp(&sin2, &sin->sin_addr, sizeof(sin2)) != 0)) {
struct ast_hostent ahp;
struct hostent *hp;
if (!(hp = ast_gethostbyname(tmp->value, &ahp)) || (memcmp(&hp->h_addr, &sin->sin_addr, sizeof(hp->h_addr)))) {
/* No match */
ast_variables_destroy(var);
var = NULL;
channels/chan_sip.c
+3 -8
View File
@@ -78,10 +78,8 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
#include "asterisk/utils.h"
#include "asterisk/file.h"
#include "asterisk/astobj.h"
#include "asterisk/dnsmgr.h"
#include "asterisk/devicestate.h"
#include "asterisk/linkedlists.h"
#include "asterisk/dnsmgr.h"
#ifdef OSP_SUPPORT
#include "asterisk/astosp.h"
@@ -789,7 +787,6 @@ struct sip_peer {
int rtpkeepalive; /*!< Send RTP packets for keepalive */
ast_group_t callgroup; /*!< Call group */
ast_group_t pickupgroup; /*!< Pickup group */
struct ast_dnsmgr_entry *dnsmgr;/*!< DNS refresh manager for peer */
struct sockaddr_in addr; /*!< IP address of peer */
/* Qualification */
@@ -1672,8 +1669,6 @@ static void sip_destroy_peer(struct sip_peer *peer)
speerobjs--;
clear_realm_authentication(peer->auth);
peer->auth = (struct sip_auth *) NULL;
if (peer->dnsmgr)
ast_dnsmgr_release(peer->dnsmgr);
free(peer);
}
@@ -1714,9 +1709,9 @@ static struct sip_peer *realtime_peer(const char *peername, struct sockaddr_in *
if (var) {
for (tmp = var; tmp; tmp = tmp->next) {
if (!strcasecmp(var->name, "host")) {
struct in_addr sin2 = { 0, };
struct ast_dnsmgr_entry *dnsmgr = NULL;
if ((ast_dnsmgr_lookup(tmp->value, &sin2, &dnsmgr) < 0) || (memcmp(&sin2, &sin->sin_addr, sizeof(sin2)) != 0)) {
struct hostent *hp;
struct ast_hostent ahp;
if (!(hp = ast_gethostbyname(tmp->value, &ahp)) || (memcmp(&hp->h_addr, &sin->sin_addr, sizeof(hp->h_addr)))) {
/* No match */
ast_variables_destroy(var);
var = NULL;