[asterisk-bugs] [JIRA] (ASTERISK-23496) Segfault cuased due to Address 0x3 out of bounds for digest parsing

[Ross Beer (JIRA)]

Ross Beer created ASTERISK-23496:
------------------------------------

             Summary: Segfault cuased due to Address 0x3 out of bounds for digest parsing
                 Key: ASTERISK-23496
                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-23496
             Project: Asterisk
          Issue Type: Bug
      Security Level: None
          Components: Channels/chan_sip/Registration, Channels/chan_sip/Security Framework
    Affects Versions: 1.8.26.1
         Environment: CentOS 6.5
            Reporter: Ross Beer
         Attachments: backtrace.txt

Asterisk segfaults randomly with a large number of SIP registrations. This issue was not present in 1.8.23.1 and has appeared in later versions.

The issue looks related to parsing of the digest in sip packets

Thread 30 (Thread 36177):
#0  0x00002b900ca36343 in ?? ()
#1  0x000000000053a0c0 in tdd_generate (tdd=0x7e53c0, buf=0x2b9030000938 "\260\271nl\223+", 
    str=<value optimized out>) at tdd.c:355
#2  0x0000000000000003 in ?? ()
#3  0x0000000000545ddb in ast_parse_digest (digest=0x3 <Address 0x3 out of bounds>, d=0x2b902b1919c0, 
    request=-888698275, pedantic=1063939106) at utils.c:2094
#4  0x3f6a6c22cb078a5d in ?? ()
#5  0x00007ffff042f740 in ?? ()
#6  0x00002b902b1919c0 in ?? ()
#7  0x0000000000000000 in ?? ()

Backtrace attached, though I think its not a full bt



--
This message was sent by Atlassian JIRA
(v6.2#6252)