[asterisk-commits] bebuild: tag 11.5.1 r397828 - in /tags/11.5.1: ./ channels/

[SVN commits to the Asterisk project]

Author: bebuild
Date: Tue Aug 27 14:25:11 2013
New Revision: 397828

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=397828
Log:
Merge changes for 11.5.1

* AST-2013-004
* AST-2013-005

Removed:
    tags/11.5.1/asterisk-11.5.0-summary.html
    tags/11.5.1/asterisk-11.5.0-summary.txt
Modified:
    tags/11.5.1/   (props changed)
    tags/11.5.1/.version
    tags/11.5.1/ChangeLog
    tags/11.5.1/channels/chan_sip.c

Propchange: tags/11.5.1/
------------------------------------------------------------------------------
Binary property 'branch-10-merged' - no diff available.

Propchange: tags/11.5.1/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Tue Aug 27 14:25:11 2013
@@ -1,2 +1,2 @@
-/branches/11:391334
+/branches/11:391334,397712,397758
 /certified/branches/1.8.15:382389

Modified: tags/11.5.1/.version
URL: http://svnview.digium.com/svn/asterisk/tags/11.5.1/.version?view=diff&rev=397828&r1=397827&r2=397828
==============================================================================
--- tags/11.5.1/.version (original)
+++ tags/11.5.1/.version Tue Aug 27 14:25:11 2013
@@ -1,1 +1,1 @@
-11.5.0
+11.5.1

Modified: tags/11.5.1/ChangeLog
URL: http://svnview.digium.com/svn/asterisk/tags/11.5.1/ChangeLog?view=diff&rev=397828&r1=397827&r2=397828
==============================================================================
--- tags/11.5.1/ChangeLog (original)
+++ tags/11.5.1/ChangeLog Tue Aug 27 14:25:11 2013
@@ -1,3 +1,36 @@
+2013-08-27  Asterisk Development Team <asteriskteam at digium.com>
+
+	* Asterisk 11.5.1 Released.
+
+	* AST-2013-005: Remote crash from invalid SDP
+
+	If the SIP channel driver processes an invalid SDP that defines media
+	descriptions before connection information, it may attempt to
+	reference the socket address information even though that information
+	has not yet been set. This will cause a crash.
+
+	This patch adds checks when handling the various media descriptions
+	that ensures the media descriptions are handled only if we have
+	connection information suitable for that media.
+
+	Thanks to Walter Doekes, OSSO B.V., for reporting, testing, and
+	providng the solution to this problem.
+
+	* AST-2013-004: Fix crash when handling ACK on dialog that has no
+	channel
+
+	A remotely exploitable crash vulnerability exists in the SIP channel
+	driver if an ACK with SDP is received after the channel has been
+	terminated. The handling code incorrectly assumed that the channel
+	would always be present.
+
+	This patch adds a check such that the SDP will only be parsed and
+	applied if Asterisk has a channel present that is associated with the
+	dialog.
+
+	Note that the patch being applied was modified only slightly from the
+	patch provided by Walter Doekes of OSSO B.V.
+
 2013-07-15  Asterisk Development Team <asteriskteam at digium.com>
 
 	* Asterisk 11.5.0 Released.

Modified: tags/11.5.1/channels/chan_sip.c
URL: http://svnview.digium.com/svn/asterisk/tags/11.5.1/channels/chan_sip.c?view=diff&rev=397828&r1=397827&r2=397828
==============================================================================
--- tags/11.5.1/channels/chan_sip.c (original)
+++ tags/11.5.1/channels/chan_sip.c Tue Aug 27 14:25:11 2013
@@ -10566,7 +10566,7 @@
 
 	/* Setup audio address and port */
 	if (p->rtp) {
-		if (portno > 0) {
+		if (sa && portno > 0) {
 			start_ice(p->rtp);
 			ast_sockaddr_set_port(sa, portno);
 			ast_rtp_instance_set_remote_address(p->rtp, sa);
@@ -10614,7 +10614,7 @@
 
 	/* Setup video address and port */
 	if (p->vrtp) {
-		if (vportno > 0) {
+		if (vsa && vportno > 0) {
 			start_ice(p->vrtp);
 			ast_sockaddr_set_port(vsa, vportno);
 			ast_rtp_instance_set_remote_address(p->vrtp, vsa);
@@ -10632,7 +10632,7 @@
 
 	/* Setup text address and port */
 	if (p->trtp) {
-		if (tportno > 0) {
+		if (tsa && tportno > 0) {
 			start_ice(p->trtp);
 			ast_sockaddr_set_port(tsa, tportno);
 			ast_rtp_instance_set_remote_address(p->trtp, tsa);
@@ -10656,7 +10656,7 @@
 
 	/* Setup image address and port */
 	if (p->udptl) {
-		if (udptlportno > 0) {
+		if (isa && udptlportno > 0) {
 			if (ast_test_flag(&p->flags[1], SIP_PAGE2_SYMMETRICRTP) && ast_test_flag(&p->flags[1], SIP_PAGE2_UDPTL_DESTINATION)) {
 				ast_rtp_instance_get_remote_address(p->rtp, isa);
 				if (!ast_sockaddr_isnull(isa) && debug) {
@@ -28214,7 +28214,7 @@
 			p->invitestate = INV_TERMINATED;
 			p->pendinginvite = 0;
 			acked = __sip_ack(p, seqno, 1 /* response */, 0);
-			if (find_sdp(req)) {
+			if (p->owner && find_sdp(req)) {
 				if (process_sdp(p, req, SDP_T38_NONE)) {
 					return -1;
 				}