kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-11-17 15:29:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix segfault for certain invalid WebSocket input.

Browse Source 
The WebSocket code would allocate, on the stack, a string large enough
to hold a key provided by the client, and the WEBSOCKET_GUID. If the key
is NULL, this causes a segfault. If the key is too large, it could
overflow the stack.

This patch checks the key for NULL and checks the length of the key to
avoid stack smashing nastiness.

(closes issue ASTERISK-21825)
Reported by: Alfred Farrugia
Tested by: Alfred Farrugia, David M. Lee
Patches:
    issueA21825_check_if_key_is_sent.patch uploaded by Walter Doekes (license 5674)


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@391560 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
David M. Lee
2013-06-12 21:00:38 +00:00
parent 56a4d03ee2
commit 7e0ebaa2e0
1 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
res/res_http_websocket.c
View File

@@ -544,9 +544,18 @@ static int websocket_callback(struct ast_tcptls_session_instance *ser, const str
/* Version 7 defined in specification http://tools.ietf.org/html/draft-ietf-hybi-thewebsocketprotocol-07 */
/* Version 8 defined in specification http://tools.ietf.org/html/draft-ietf-hybi-thewebsocketprotocol-10 */
/* Version 13 defined in specification http://tools.ietf.org/html/rfc6455 */
char combined[strlen(key) + strlen(WEBSOCKET_GUID) + 1], base64[64];
char *combined, base64[64];
unsigned combined_length;
uint8_t sha[20];
combined_length = (key ? strlen(key) : 0) + strlen(WEBSOCKET_GUID) + 1;
if (!key || combined_length > 8192) { /* no stack overflows please */
fputs("HTTP/1.1 400 Bad Request\r\n"
"Sec-WebSocket-Version: 7, 8, 13\r\n\r\n", ser->f);
ao2_ref(protocol_handler, -1);
return 0;
}
if (!(session = ao2_alloc(sizeof(*session), session_destroy_fn))) {
ast_log(LOG_WARNING, "WebSocket connection from '%s' could not be accepted\n",
ast_sockaddr_stringify(&ser->remote_address));
@@ -556,7 +565,8 @@ static int websocket_callback(struct ast_tcptls_session_instance *ser, const str
return 0;
}
snprintf(combined, sizeof(combined), "%s%s", key, WEBSOCKET_GUID);
combined = ast_alloca(combined_length);
snprintf(combined, combined_length, "%s%s", key, WEBSOCKET_GUID);
ast_sha1_hash_uint(sha, combined);
ast_base64encode(base64, (const unsigned char*)sha, 20, sizeof(base64));