[asterisk-bugs] [JIRA] (ASTERISK-30259) ari: Crash on missing JSON validation in push registration

[Thomas Guebels (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-30259?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Thomas Guebels updated ASTERISK-30259:
--------------------------------------

    Attachment: ari_push_json_validation_crash.diff

The crash seems to come from the fact that the code expects to have objects in the field array that have "attribute" and "value" keys and these can only be strings.

The attached patch adds validation so that the 2 cases shown in the description do not trigger a crash anymore, but only skip the field.

> ari: Crash on missing JSON validation in push registration
> ----------------------------------------------------------
>
>                 Key: ASTERISK-30259
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-30259
>             Project: Asterisk
>          Issue Type: Bug
>      Security Level: None
>          Components: Resources/res_ari, Resources/res_pjsip_outbound_registration
>    Affects Versions: 18.14.0
>            Reporter: Thomas Guebels
>            Assignee: Unassigned
>              Labels: patch
>         Attachments: ari_push_json_validation_crash.diff
>
>
> When creating a new outbound registration using ARI push method, an unexpected JSON body can easily trigger a crash.
> The code expects "attribute" and "value" to be present and to be string in the objects of the field array.
> So anything not in the form 
> {code}
> [
>   {
>     "attribute": "string",
>     "value": "string"
>   },
> ]
> {code}
> will trigger it. Example: 
> {code}
> [
>   {
>     "attribute": "string",
>     "value": 123
>   },
> ]
> {code}
> or
> {code}
> [
>   {
>   },
> ]
> {code}
> This is the backtrace:
> {code}
> #0  0x00007f33c6f28bea in ?? () from /lib/x86_64-linux-gnu/libc.so.6
> #1  0x000055b026c5028c in _ast_variable_new (name=0x7f32f4001b90 "max_retries", value=0x0, filename=0x7f3371c7c502 "", file=0x7f3371c7c406 "ari/resource_asterisk.c", 
>     func=0x7f3371c7cb00 <__PRETTY_FUNCTION__.15793> "ast_ari_asterisk_update_object", lineno=197) at config.c:292
> #2  0x00007f3371c7a3a3 in ast_ari_asterisk_update_object (headers=0x7f32f4000ec0, args=0x7f333d552880, response=0x7f333d552ae0) at ari/resource_asterisk.c:197
> #3  0x00007f3371c78b73 in ast_ari_asterisk_update_object_cb (ser=0x7f3350000bd0, get_params=0x0, path_vars=0x7f32f40015e0, headers=0x7f32f4000ec0, body=0x7f32f4001910, response=0x7f333d552ae0)
>     at res_ari_asterisk.c:161
> #4  0x00007f3372ef86f9 in ast_ari_invoke (ser=0x7f3350000bd0, uri=0x7f333d552c49 "asterisk/config/dynamic/res_pjsip/registration/2f35c461-5f59-4fc5-8c59-f191a97fdb03", method=AST_HTTP_PUT, get_params=0x0, 
>     headers=0x7f32f4000ec0, body=0x7f32f4001910, response=0x7f333d552ae0) at res_ari.c:587
> #5  0x00007f3372ef9e79 in ast_ari_callback (ser=0x7f3350000bd0, urih=0x7f3372f06040 <http_uri>, uri=0x7f333d552c49 "asterisk/config/dynamic/res_pjsip/registration/2f35c461-5f59-4fc5-8c59-f191a97fdb03", 
>     method=AST_HTTP_PUT, get_params=0x0, headers=0x7f32f4000ec0) at res_ari.c:1058
> #6  0x000055b026c6fb53 in handle_uri (ser=0x7f3350000bd0, uri=0x7f333d552c49 "asterisk/config/dynamic/res_pjsip/registration/2f35c461-5f59-4fc5-8c59-f191a97fdb03", method=AST_HTTP_PUT, headers=0x7f32f4000ec0)
>     at http.c:1490
> #7  0x000055b026c70d7e in httpd_process_request (ser=0x7f3350000bd0) at http.c:1931
> #8  0x000055b026c710c3 in httpd_helper_thread (data=0x7f3350000bd0) at http.c:1994
> #9  0x000055b026c0e39b in handle_tcptls_connection (data=0x7f3350000bd0) at tcptls.c:274
> #10 0x000055b026c21de6 in dummy_start (data=0x55b02779cc60) at utils.c:1574
> #11 0x00007f33c7214609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
> #12 0x00007f33c6f96133 in clone () from /lib/x86_64-linux-gnu/libc.so.6
> {code}



--
This message was sent by Atlassian JIRA
(v6.2#6252)