[asterisk-bugs] [JIRA] (ASTERISK-19941) Crash in res_config_ldap when used with realtime extensions

[Matt Jordan (JIRA)]

    [ https://issues.asterisk.org/jira/browse/ASTERISK-19941?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=216960#comment-216960 ] 

Matt Jordan edited comment on ASTERISK-19941 at 6/3/14 11:03 AM:
-----------------------------------------------------------------

I think there's a problem with the va_list (ap) being passed down into the realtime_ldap_base_ap() function, which might mutate it. The following link, which references the C standard, suggests the results of doing this are indeterminate for the caller: https://www.securecoding.cert.org/confluence/display/seccode/MSC39-C.+Do+not+call+va_arg()+on+a+va_list+that+has+an+indeterminate+value

This patch fixes the problem on our servers:

\[Edit: mjordan\]

Removed inline patch.



was (Author: cjr):
I think there's a problem with the va_list (ap) being passed down into the realtime_ldap_base_ap() function, which might mutate it. The following link, which references the C standard, suggests the results of doing this are indeterminate for the caller: https://www.securecoding.cert.org/confluence/display/seccode/MSC39-C.+Do+not+call+va_arg()+on+a+va_list+that+has+an+indeterminate+value

This patch fixes the problem on our servers:

{code:title=Patch}
--- res/res_config_ldap.c.orig	2014-04-01 13:28:23.412117882 +0100
+++ res/res_config_ldap.c	2014-04-01 13:33:15.609117587 +0100
@@ -963,10 +963,13 @@
 	char *op;
 	const char *initfield = NULL;
 	const char *newparam, *newval;
-	struct ast_variable **vars =
-		realtime_ldap_base_ap(NULL, basedn, table_name, ap);
+	va_list ap2;
+	struct ast_variable **vars;
 	struct ast_config *cfg = NULL;
 
+	va_copy(ap2, ap);
+	vars = realtime_ldap_base_ap(NULL, basedn, table_name, ap2);
+
 	newparam = va_arg(ap, const char *);
 	newval = va_arg(ap, const char *);
 	if (!newparam || !newval) {
{code}

> Crash in res_config_ldap when used with realtime extensions
> -----------------------------------------------------------
>
>                 Key: ASTERISK-19941
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-19941
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Resources/res_config_ldap
>    Affects Versions: 1.8.11.1, 11.5.1
>         Environment: Asterisk Now 2.2 GUI and LDAP Imap voicemail registration 
>            Reporter: Slava Bendersky
>            Severity: Critical
>              Labels: realtime
>         Attachments: backtrace.txt
>
>
> Asterisk trying to modify entries in LDAP server DS 389.
> Also when I got sip user registered and I trying place call it just silence, I don't see any attempts to dial in logs. 
> [2012-05-28 00:07:18] ERROR[25975]: res_config_ldap.c:1328 update_ldap: Couldn't modify 'name'='sbendersky', dn:uid=,ou=People,dc=,dc= because No such attribute
>     -- Registered SIP 'sbendersky' at 10.16.130.45:32899
> [2012-05-28 00:07:20] ERROR[26001]: res_config_ldap.c:1328 update_ldap: Couldn't modify 'name'='sbendersky', dn:uid=sbendersky,ou=People,dc=networklab,dc=ca because Object class violation
>     -- Unregistered SIP 'sbendersky'
> [2012-05-28 00:07:26] ERROR[26001]: res_config_ldap.c:1328 update_ldap: Couldn't modify 'name'='sbendersky', dn:uid=sbendersky,ou=People,dc=networklab,dc=ca because No such attribute
> Extension conf
> [users]
> switch => Realtime/@
> [voicemail]
> switch => Realtime/@
> [realtime-ldap]
> include => users
> include => voicemail
> Extconfig conf
> [settings]
> sipusers => ldap,"ou=People,dc=networklab,dc=ca",sip
> sippeers => ldap,"ou=People,dc=networklab,dc=ca",sip
> extensions => ldap,"ou=NetLabExtensions,dc=networklab,dc=ca",extensions
> voicemail => ldap,"ou=NetLabVoicemail,dc=networklab,dc=ca",voicemail



--
This message was sent by Atlassian JIRA
(v6.2#6252)