[asterisk-bugs] [JIRA] (ASTERISK-22432) Async AGI crashes Asterisk when issuing "set variable" command without args

[George Joseph (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-22432?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

George Joseph updated ASTERISK-22432:
-------------------------------------

    Target Release Version/s: 14.6.0

> Async AGI crashes Asterisk when issuing "set variable" command without args
> ---------------------------------------------------------------------------
>
>                 Key: ASTERISK-22432
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-22432
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Resources/res_agi
>         Environment: Fresh install of squeeze-xivo-skaro-13.16.iso
>            Reporter: Antoine Pitrou
>            Assignee: Sean Bright
>      Target Release: 13.17.0, 14.6.0
>
>
> Banner is the following:
> 11.5.0+pf.xivo.13.16~20130722.141054.2668289,
> Actions to reproduce: open an AMI session using telnet, trigger an async AGI session and then type:
> {noformat}
> action: agi
> actionid: FOOBAR.568
> CommandID: 124
> command: set variable
> Channel: <AGI channel name>
> Response: Success
> ActionID: FOOBAR.568
> Message: Added AGI command to queue
> {noformat}
> At this point Asterisk crashes (the AMI connection is closed).
> {noformat}
> gdb stack trace:
> (gdb) bt
> #0  0xb767e073 in strlen () from /lib/libc.so.6
> #1  0x0818c754 in pbx_builtin_setvar_helper ()
> #2  0xb6e87b57 in ?? () from /usr/lib/asterisk/modules/res_agi.so
> #3  0xb6e8d053 in ?? () from /usr/lib/asterisk/modules/res_agi.so
> #4  0xb6e8f7dd in ?? () from /usr/lib/asterisk/modules/res_agi.so
> #5  0x08184eca in pbx_exec ()
> #6  0x081916a6 in ?? ()
> #7  0x08199087 in ?? ()
> #8  0x0819b390 in ?? ()
> #9  0x081e222b in ?? ()
> #10 0xb72937b0 in start_thread () from /lib/libpthread.so.0
> #11 0xb76d6cde in clone () from /lib/libc.so.6
> {noformat}
> I've made a SVN checkout of Asterisk and identified the likely cause of the problem:
> in res/res_agi.c, handle_setvariable() calls pbx_builtin_setvar_helper(chan, argv[2], argv[3]).
> However, if "set variable" is called with too few arguments, argv[2] and argv[3] may be unitialized.
> Then pbx_builtin_setvar_helper() calls strlen(argv[2]) and crashes.



--
This message was sent by Atlassian JIRA
(v6.2#6252)