Matthew Jordan c61d49d5cc Fix remotely exploitable stack overrun in Milliwatt ...

Milliwatt is vulnerable to a remotely exploitable stack overrun when using
the 'o' option.  This occurs due to the milliwatt_generate function not
accounting for AST_FRIENDLY_OFFSET when calculating the maximum number of
samples it can put in the output buffer.

This patch resolves this issue by taking into account AST_FRIENDLY_OFFSET
when determining the maximum number of samples allowed.  Note that at no
point is remote code execution possible.  The data that is written into the
buffer is the pre-defined Milliwatt data, and not custom data.

(closes issue ASTERISK-19541)
Reported by: Russell Bryant
Tested by: Matt Jordan
Patches:
  milliwatt_stack_overrun.rev1.txt by Russell Bryant (license 6283)
  Note that this patch was written by Russell, even though Matt uploaded it
........

Merged revisions 359645 from http://svn.asterisk.org/svn/asterisk/branches/1.6.2
........

Merged revisions 359656 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 359694 from http://svn.asterisk.org/svn/asterisk/branches/10


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@359704 65c4cc65-6c06-0410-ace0-fbb531ad65f3

2012-03-15 18:55:54 +00:00

..

confbridge

Transition app_page to using app_confbridge internally for the conference bridge portion of paging. This also adds a new 'announcement' option to ConfBridge user profiles.

2012-03-10 20:06:46 +00:00

app_adsiprog.c

Replace direct access to channel name with accessor functions

2012-01-09 22:15:50 +00:00

app_alarmreceiver.c

Opaquify ast_channel structs and lists

2012-02-29 16:52:47 +00:00

app_amd.c

Opaquify ast_channel structs and lists

2012-02-29 16:52:47 +00:00

app_authenticate.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_cdr.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_celgenuserevent.c

Merged revisions 282979 via svnmerge from

2010-08-20 11:54:22 +00:00

app_chanisavail.c

app_chanisavail: Fix use of uninitialized variable.

2012-03-14 23:29:32 +00:00

app_channelredirect.c

Finalize ast_channel opaquification

2012-03-13 18:20:34 +00:00

app_chanspy.c

Finalize ast_channel opaquification

2012-03-13 18:20:34 +00:00

app_confbridge.c

Finalize ast_channel opaquification

2012-03-13 18:20:34 +00:00

app_controlplayback.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

app_dahdibarge.c

Opaquify ast_channel typedefs, fd arrays, and softhangup flag

2012-03-01 22:09:18 +00:00

app_dahdiras.c

Opaquify ast_channel typedefs, fd arrays, and softhangup flag

2012-03-01 22:09:18 +00:00

app_db.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

app_dial.c

Add missing connected line macro calls to initial dial for Dial and Queue apps.

2012-03-15 18:32:22 +00:00

app_dictate.c

Opaquification for ast_format structs in struct ast_channel

2012-02-24 00:32:20 +00:00

app_directed_pickup.c

Opaquify ast_channel typedefs, fd arrays, and softhangup flag

2012-03-01 22:09:18 +00:00

app_directory.c

Resolve a few more cases of variable shadowing.

2012-03-08 17:48:14 +00:00

app_disa.c

Finalize ast_channel opaquification

2012-03-13 18:20:34 +00:00

app_dumpchan.c

Finalize ast_channel opaquification

2012-03-13 18:20:34 +00:00

app_echo.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_exec.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

app_externalivr.c

Fix invalid reads/writes due to incorrect sizeof().

2012-03-14 10:05:07 +00:00

app_fax.c

Opaquify ast_channel structs and lists

2012-02-29 16:52:47 +00:00

app_festival.c

Opaquification for ast_format structs in struct ast_channel

2012-02-24 00:32:20 +00:00

app_flash.c

Opaquify ast_channel typedefs, fd arrays, and softhangup flag

2012-03-01 22:09:18 +00:00

app_followme.c

Finalize ast_channel opaquification

2012-03-13 18:20:34 +00:00

app_forkcdr.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_getcpeid.c

Replace direct access to channel name with accessor functions

2012-01-09 22:15:50 +00:00

app_ices.c

Opaquification for ast_format structs in struct ast_channel

2012-02-24 00:32:20 +00:00

app_image.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

app_ivrdemo.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_jack.c

Replace direct access to channel name with accessor functions

2012-01-09 22:15:50 +00:00

app_macro.c

Finalize ast_channel opaquification

2012-03-13 18:20:34 +00:00

app_meetme.c

Opaquify ast_channel typedefs, fd arrays, and softhangup flag

2012-03-01 22:09:18 +00:00

app_milliwatt.c

Fix remotely exploitable stack overrun in Milliwatt

2012-03-15 18:55:54 +00:00

app_minivm.c

Opaquify ast_channel structs and lists

2012-02-29 16:52:47 +00:00

app_mixmonitor.c

Finalize ast_channel opaquification

2012-03-13 18:20:34 +00:00

app_morsecode.c

Merged revisions 336717 via svnmerge from

2011-09-19 20:23:29 +00:00

app_mp3.c

Opaquification for ast_format structs in struct ast_channel

2012-02-24 00:32:20 +00:00

app_nbscat.c

Opaquification for ast_format structs in struct ast_channel

2012-02-24 00:32:20 +00:00

app_originate.c

Added support for all slin formats to app_originate

2011-12-14 22:36:30 +00:00

app_osplookup.c

Opaquify ast_channel structs and lists

2012-02-29 16:52:47 +00:00

app_page.c

Transition app_page to using app_confbridge internally for the conference bridge portion of paging. This also adds a new 'announcement' option to ConfBridge user profiles.

2012-03-10 20:06:46 +00:00

app_parkandannounce.c

Finalize ast_channel opaquification

2012-03-13 18:20:34 +00:00

app_playback.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_playtones.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_privacy.c

Opaquify ast_channel structs and lists

2012-02-29 16:52:47 +00:00

app_queue.c

Add missing connected line macro calls to initial dial for Dial and Queue apps.

2012-03-15 18:32:22 +00:00

app_read.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_readexten.c

Opaquify ast_channel structs and lists

2012-02-29 16:52:47 +00:00

app_readfile.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

app_record.c

Opaquification for ast_format structs in struct ast_channel

2012-02-24 00:32:20 +00:00

app_saycounted.c

Merged revisions 336717 via svnmerge from

2011-09-19 20:23:29 +00:00

app_sayunixtime.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_senddtmf.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

app_sendtext.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_setcallerid.c

Opaquify ast_channel structs and lists

2012-02-29 16:52:47 +00:00

app_skel.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

app_sms.c

Opaquify ast_channel structs and lists

2012-02-29 16:52:47 +00:00

app_softhangup.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_speech_utils.c

Finalize ast_channel opaquification

2012-03-13 18:20:34 +00:00

app_stack.c

Finalize ast_channel opaquification

2012-03-13 18:20:34 +00:00

app_system.c

If the argument to the system application is quoted, ensure we remove the quotes before trying to execute.

2010-03-11 20:25:02 +00:00

app_talkdetect.c

Finalize ast_channel opaquification

2012-03-13 18:20:34 +00:00

app_test.c

Opaquification for ast_format structs in struct ast_channel

2012-02-24 00:32:20 +00:00

app_transfer.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_url.c

Merged revisions 339777 via svnmerge from

2011-10-07 19:37:33 +00:00

app_userevent.c

Opaquify channel stringfields

2012-01-24 20:12:09 +00:00

app_verbose.c

ast_channel opaquification of pointers and integral types

2012-02-20 23:43:27 +00:00

app_voicemail.c

Fix IMAP storage compilation after opaquification changes

2012-03-13 18:55:14 +00:00

app_voicemail.exports.in

Allow symbol export filtering to work properly on platforms that have symbol prefixes.

2010-04-02 18:57:58 +00:00

app_waitforring.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

app_waitforsilence.c

Opaquification for ast_format structs in struct ast_channel

2012-02-24 00:32:20 +00:00

app_waituntil.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

app_while.c

Opaquify ast_channel structs and lists

2012-02-29 16:52:47 +00:00

app_zapateller.c

Opaquify ast_channel structs and lists

2012-02-29 16:52:47 +00:00

enter.h

…

leave.h

…

Makefile

New HD ConfBridge conferencing application.

2011-04-21 18:11:40 +00:00

rpt_flow.pdf

…