[asterisk-bugs] [JIRA] (ASTERISK-21825) [patch] websocket segmentation fault on certain invalid input

[Matt Jordan (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-21825?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Matt Jordan updated ASTERISK-21825:
-----------------------------------

    Target Release Version/s: 1.8.24.0
    
> [patch] websocket segmentation fault on certain invalid input
> -------------------------------------------------------------
>
>                 Key: ASTERISK-21825
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-21825
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Resources/res_http_websocket
>    Affects Versions: 11.3.0, 11.4.0
>         Environment: Ubuntu 12.10 x86_64
>            Reporter: Alfred Farrugia
>            Severity: Critical
>      Target Release: 1.8.24.0
>
>         Attachments: backtrace.txt, issueA21825_check_if_key_is_sent.patch
>
>
> Asterisk crashes when an invalid websocket request is performed, for example:
> python -c "print 'GET /ws HTTP/1.1\r\nHost: localhost:8088\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Key: \x02\r\nSec-WebSocket-Protocol: sip\r\nSec-WebSocket-Version: 7, 8, 13\r\nOrigin: http://example.com\r\n\r\n'" | nc localhost 8088
> ie: passing \x00 as the websocket key
> crashes and produces the attached backtrace

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.asterisk.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira