[asterisk-bugs] [JIRA] (ASTERISK-24566) Uninit buf in WS close()
Badalian Vyacheslav (JIRA)
noreply at issues.asterisk.org
Thu Dec 18 16:16:29 CST 2014
[ https://issues.asterisk.org/jira/browse/ASTERISK-24566?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=224089#comment-224089 ]
Badalian Vyacheslav edited comment on ASTERISK-24566 at 12/18/14 4:14 PM:
--------------------------------------------------------------------------
asterisk 11.15.0
ast_websocket_write: line 237
{code}
- memset(frame, 0, sizeof(*frame));
+ memset(frame, 0, header_size);
{code}
sizeof(*frame) = 1
sizeof(frame) = 8
but we need zero all {{frame}}. it's size is {{header_size}}
founded by valgrind:
{code}
==22077== Thread 29:
==22077== Conditional jump or move depends on uninitialised value(s)
==22077== at 0x37C9E722CB: _IO_file_overflow@@GLIBC_2.2.5 (fileops.c:872)
==22077== by 0x37C9E74638: _IO_default_xsputn (genops.c:485)
==22077== by 0x37C9E71791: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:1372)
==22077== by 0x37C9E67A4C: fwrite (iofwrite.c:45)
==22077== by 0x599927: ast_careful_fwrite (utils.c:1434)
==22077== by 0xA20B161: ast_websocket_write (res_http_websocket.c:256)
==22077== by 0x10FB0FB5: __sip_xmit (chan_sip.c:3731)
==22077== by 0x10FB4C30: send_response (chan_sip.c:4609)
==22077== by 0x10FD6D0A: __transmit_response (chan_sip.c:11957)
==22077== by 0x10FD740D: transmit_response (chan_sip.c:12047)
==22077== by 0x11025736: handle_request_bye (chan_sip.c:26884)
==22077== by 0x1102C46F: handle_incoming (chan_sip.c:28368)
==22077== by 0x1102CEC9: handle_request_do (chan_sip.c:28548)
==22077== by 0x10FAD4CD: sip_websocket_callback (chan_sip.c:2617)
==22077== by 0xA20CAA1: websocket_callback (res_http_websocket.c:681)
==22077== Uninitialised value was created by a stack allocation
==22077== at 0xA20AFB9: ast_websocket_write (res_http_websocket.c:220)
==22077==
==22077== Syscall param write(buf) points to uninitialised byte(s)
==22077== at 0x37C9EDB61D: ??? (syscall-template.S:82)
==22077== by 0x588414: tcptls_stream_write (tcptls.c:335)
==22077== by 0x37C9E66FD8: _IO_cookie_write (iofopncook.c:72)
==22077== by 0x37C9E73084: new_do_write (fileops.c:522)
==22077== by 0x37C9E73084: _IO_do_write@@GLIBC_2.2.5 (fileops.c:495)
==22077== by 0x37C9E723DE: _IO_file_overflow@@GLIBC_2.2.5 (fileops.c:881)
==22077== by 0x37C9E74638: _IO_default_xsputn (genops.c:485)
==22077== by 0x37C9E71791: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:1372)
==22077== by 0x37C9E67A4C: fwrite (iofwrite.c:45)
==22077== by 0x599927: ast_careful_fwrite (utils.c:1434)
==22077== by 0xA20B161: ast_websocket_write (res_http_websocket.c:256)
==22077== by 0x10FB0FB5: __sip_xmit (chan_sip.c:3731)
==22077== by 0x10FB4C30: send_response (chan_sip.c:4609)
==22077== by 0x10FD6D0A: __transmit_response (chan_sip.c:11957)
==22077== by 0x10FD740D: transmit_response (chan_sip.c:12047)
==22077== by 0x11025736: handle_request_bye (chan_sip.c:26884)
==22077== Address 0x6187ca3 is 131 bytes inside a block of size 280 alloc'd
==22077== at 0x4A0720A: malloc (vg_replace_malloc.c:296)
==22077== by 0x37C9E6718D: fopencookie@@GLIBC_2.2.5 (iofopncook.c:200)
==22077== by 0x588803: tcptls_stream_fopen (tcptls.c:506)
==22077== by 0x588ABD: handle_tcptls_connection (tcptls.c:592)
==22077== by 0x5990D4: dummy_start (utils.c:1223)
==22077== by 0x37CA2079D0: start_thread (pthread_create.c:301)
==22077== by 0x37C9EE89DC: clone (clone.S:115)
==22077== Uninitialised value was created by a stack allocation
==22077== at 0xA20AFB9: ast_websocket_write (res_http_websocket.c:220)
{code}
was (Author: slavon):
asterisk 11.15.0
ast_websocket_write: line 237
{code}
- memset(frame, 0, sizeof(*frame));
+ memset(frame, 0, header_size);
{code}
sizeof(*frame) = 1
sizeof(frame) = 8
but we need zero all {{frame}}. it's size is {{header_size}}
> Uninit buf in WS close()
> ------------------------
>
> Key: ASTERISK-24566
> URL: https://issues.asterisk.org/jira/browse/ASTERISK-24566
> Project: Asterisk
> Issue Type: Bug
> Security Level: None
> Components: Resources/res_http_websocket
> Affects Versions: 11.14.1, 11.15.0
> Reporter: Badalian Vyacheslav
> Assignee: Badalian Vyacheslav
> Severity: Critical
> Attachments: un.diff
>
>
> {code}
> ==50066== Thread 35:
> ==50066== Conditional jump or move depends on uninitialised value(s)
> ==50066== at 0x37C9E722CB: _IO_file_overflow@@GLIBC_2.2.5 (fileops.c:872)
> ==50066== by 0x37C9E74638: _IO_default_xsputn (genops.c:485)
> ==50066== by 0x37C9E71791: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:1372)
> ==50066== by 0x37C9E67A4C: fwrite (iofwrite.c:45)
> ==50066== by 0x59A62E: ast_careful_fwrite (utils.c:1403)
> ==50066== by 0x9F86F96: ast_websocket_close (res_http_websocket.c:211)
> ==50066== by 0x9F86B3B: session_destroy_fn (res_http_websocket.c:125)
> ==50066== by 0x44D123: internal_ao2_ref (astobj2.c:466)
> ==50066== by 0x44D444: __ao2_ref (astobj2.c:548)
> ==50066== by 0x9F872D9: ast_websocket_unref (res_http_websocket.c:288)
> ==50066== by 0x11245ACD: __sip_destroy (chan_sip.c:6487)
> ==50066== by 0x11246A92: sip_destroy (chan_sip.c:6688)
> ==50066== Uninitialised value was created by a stack allocation
> ==50066== at 0x9F86EA9: ast_websocket_close (res_http_websocket.c:193)
> ==50066==
> ==50066== Syscall param write(buf) points to uninitialised byte(s)
> ==50066== at 0x37C9EDB61D: ??? (syscall-template.S:82)
> ==50066== by 0x5891EC: tcptls_stream_write (tcptls.c:335)
> ==50066== by 0x37C9E66FD8: _IO_cookie_write (iofopncook.c:72)
> ==50066== by 0x37C9E73084: _IO_do_write@@GLIBC_2.2.5 (fileops.c:522)
> ==50066== by 0x37C9E723DE: _IO_file_overflow@@GLIBC_2.2.5 (fileops.c:881)
> ==50066== by 0x37C9E74638: _IO_default_xsputn (genops.c:485)
> ==50066== by 0x37C9E71791: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:1372)
> ==50066== by 0x37C9E67A4C: fwrite (iofwrite.c:45)
> ==50066== by 0x59A62E: ast_careful_fwrite (utils.c:1403)
> ==50066== by 0x9F86F96: ast_websocket_close (res_http_websocket.c:211)
> ==50066== by 0x9F86B3B: session_destroy_fn (res_http_websocket.c:125)
> ==50066== by 0x44D123: internal_ao2_ref (astobj2.c:466)
> ==50066== Address 0x6eb0e73 is 131 bytes inside a block of size 280 alloc'd
> ==50066== at 0x4A06A2E: malloc (vg_replace_malloc.c:270)
> ==50066== by 0x37C9E6718D: fopencookie@@GLIBC_2.2.5 (iofopncook.c:200)
> ==50066== by 0x5895DB: tcptls_stream_fopen (tcptls.c:506)
> ==50066== by 0x589895: handle_tcptls_connection (tcptls.c:592)
> ==50066== by 0x599DDB: dummy_start (utils.c:1192)
> ==50066== by 0x37CA2079D0: start_thread (pthread_create.c:301)
> ==50066== by 0x37C9EE89DC: clone (clone.S:115)
> ==50066== Uninitialised value was created by a stack allocation
> ==50066== at 0x9F86EA9: ast_websocket_close (res_http_websocket.c:193)
> ==50066==
> {code}
> Patch attached bellow
--
This message was sent by Atlassian JIRA
(v6.2#6252)
More information about the asterisk-bugs
mailing list