[asterisk-commits] bebuild: tag certified-11.2-cert2 r397824 - in /certified/tags/11.2-cert2: ./...

[SVN commits to the Asterisk project]

Author: bebuild
Date: Tue Aug 27 14:22:36 2013
New Revision: 397824

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=397824
Log:
Merge changes for 11.2-cert2

* AST-2013-004
* AST-2013-005

Removed:
    certified/tags/11.2-cert2/certified-asterisk-11.2-cert1-summary.html
    certified/tags/11.2-cert2/certified-asterisk-11.2-cert1-summary.txt
Modified:
    certified/tags/11.2-cert2/   (props changed)
    certified/tags/11.2-cert2/.version
    certified/tags/11.2-cert2/ChangeLog
    certified/tags/11.2-cert2/channels/chan_sip.c

Propchange: certified/tags/11.2-cert2/
------------------------------------------------------------------------------
Binary property 'branch-11-merged' - no diff available.

Propchange: certified/tags/11.2-cert2/
------------------------------------------------------------------------------
    svn:mergeinfo = /certified/branches/11.2:397755,397762

Modified: certified/tags/11.2-cert2/.version
URL: http://svnview.digium.com/svn/asterisk/certified/tags/11.2-cert2/.version?view=diff&rev=397824&r1=397823&r2=397824
==============================================================================
--- certified/tags/11.2-cert2/.version (original)
+++ certified/tags/11.2-cert2/.version Tue Aug 27 14:22:36 2013
@@ -1,1 +1,1 @@
-11.2-cert1
+11.2-cert2

Modified: certified/tags/11.2-cert2/ChangeLog
URL: http://svnview.digium.com/svn/asterisk/certified/tags/11.2-cert2/ChangeLog?view=diff&rev=397824&r1=397823&r2=397824
==============================================================================
--- certified/tags/11.2-cert2/ChangeLog (original)
+++ certified/tags/11.2-cert2/ChangeLog Tue Aug 27 14:22:36 2013
@@ -1,3 +1,36 @@
+2013-08-27  Asterisk Development Team <asteriskteam at digium.com>
+
+	* Certified Astrisk 11.2-cert2 Released.
+
+	* AST-2013-005: Remote crash from invalid SDP
+
+	If the SIP channel driver processes an invalid SDP that defines media
+	descriptions before connection information, it may attempt to
+	reference the socket address information even though that information
+	has not yet been set. This will cause a crash.
+
+	This patch adds checks when handling the various media descriptions
+	that ensures the media descriptions are handled only if we have
+	connection information suitable for that media.
+
+	Thanks to Walter Doekes, OSSO B.V., for reporting, testing, and
+	providng the solution to this problem.
+
+	* AST-2013-004: Fix crash when handling ACK on dialog that has no
+	channel
+
+	A remotely exploitable crash vulnerability exists in the SIP channel
+	driver if an ACK with SDP is received after the channel has been
+	terminated. The handling code incorrectly assumed that the channel
+	would always be present.
+
+	This patch adds a check such that the SDP will only be parsed and
+	applied if Asterisk has a channel present that is associated with the
+	dialog.
+
+	Note that the patch being applied was modified only slightly from the
+	patch provided by Walter Doekes of OSSO B.V.
+
 2013-03-28  Asterisk Development Team <asteriskteam at digium.com>
 
 	* Certified Asterisk 11.2-cert1 Released.

Modified: certified/tags/11.2-cert2/channels/chan_sip.c
URL: http://svnview.digium.com/svn/asterisk/certified/tags/11.2-cert2/channels/chan_sip.c?view=diff&rev=397824&r1=397823&r2=397824
==============================================================================
--- certified/tags/11.2-cert2/channels/chan_sip.c (original)
+++ certified/tags/11.2-cert2/channels/chan_sip.c Tue Aug 27 14:22:36 2013
@@ -10519,7 +10519,7 @@
 
 	/* Setup audio address and port */
 	if (p->rtp) {
-		if (portno > 0) {
+		if (sa && portno > 0) {
 			start_ice(p->rtp);
 			ast_sockaddr_set_port(sa, portno);
 			ast_rtp_instance_set_remote_address(p->rtp, sa);
@@ -10567,7 +10567,7 @@
 
 	/* Setup video address and port */
 	if (p->vrtp) {
-		if (vportno > 0) {
+		if (vsa && vportno > 0) {
 			start_ice(p->vrtp);
 			ast_sockaddr_set_port(vsa, vportno);
 			ast_rtp_instance_set_remote_address(p->vrtp, vsa);
@@ -10585,7 +10585,7 @@
 
 	/* Setup text address and port */
 	if (p->trtp) {
-		if (tportno > 0) {
+		if (tsa && tportno > 0) {
 			start_ice(p->trtp);
 			ast_sockaddr_set_port(tsa, tportno);
 			ast_rtp_instance_set_remote_address(p->trtp, tsa);
@@ -10609,7 +10609,7 @@
 
 	/* Setup image address and port */
 	if (p->udptl) {
-		if (udptlportno > 0) {
+		if (isa && udptlportno > 0) {
 			if (ast_test_flag(&p->flags[1], SIP_PAGE2_SYMMETRICRTP) && ast_test_flag(&p->flags[1], SIP_PAGE2_UDPTL_DESTINATION)) {
 				ast_rtp_instance_get_remote_address(p->rtp, isa);
 				if (!ast_sockaddr_isnull(isa) && debug) {
@@ -28044,7 +28044,7 @@
 			p->invitestate = INV_TERMINATED;
 			p->pendinginvite = 0;
 			acked = __sip_ack(p, seqno, 1 /* response */, 0);
-			if (find_sdp(req)) {
+			if (p->owner && find_sdp(req)) {
 				if (process_sdp(p, req, SDP_T38_NONE)) {
 					return -1;
 				}