[asterisk-bugs] [JIRA] (ASTERISK-23508) Memory Corruption in __ast_string_field_ptr_build_va

[Matt Jordan (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-23508?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Matt Jordan updated ASTERISK-23508:
-----------------------------------

    Target Release Version/s: 13.0.0-beta1

> Memory Corruption in __ast_string_field_ptr_build_va
> ----------------------------------------------------
>
>                 Key: ASTERISK-23508
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-23508
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Utilities/General
>    Affects Versions: 11.8.0
>         Environment: Centos 6.5 / x86_64
>            Reporter: Arnd Schmitter
>      Target Release: 1.8.30.0, 11.12.0, 12.5.0, 13.0.0-beta1
>
>         Attachments: issueA23508_stringfieldptr_corruption2.patch
>
>
> We had serveral cases of memory corruption which occured inside this function, which resulted in random segmentation faults.
> We have already found the cause of the corruption:
> It happens when the variable space, at the start of the functions calculates to a value of 0.
> When the variable "available" later gets calculated, it will make a underrun and because its unsigned, the value gets very high.
> So the vsnprintf will always think there are enough bytes and write over the borders of the allocated memory area.



--
This message was sent by Atlassian JIRA
(v6.2#6252)