[asterisk-commits] mjordan: branch 10 r383977 - /branches/10/main/http.c

[SVN commits to the Asterisk project]

Author: mjordan
Date: Wed Mar 27 09:36:22 2013
New Revision: 383977

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=383977
Log:
AST-2013-002: Prevent denial of service in HTTP server

AST-2012-014, fixed in January of this year, contained a fix for Asterisk's
HTTP server for a remotely-triggered crash. While the fix put in place fixed
the possibility for the crash to be triggered, a denial of service vector still
exists with that solution if an attacker sends one or more HTTP POST requests
with very large Content-Length values. This patch resolves this by capping
the Content-Length at 1024 bytes. Any attempt to send an HTTP POST with
Content-Length greater than this cap will not result in any memory allocation.
The POST will be responded to with an HTTP 413 "Request Entity Too Large"
response.

This issue was reported by Christoph Hebeisen of TELUS Security Labs

(closes issue ASTERISK-20967)
Reported by: Christoph Hebeisen
patches:
  AST-2013-002-1.8.diff uploaded by mmichelson (License 5049)
  AST-2013-002-10.diff uploaded by mmichelson (License 5049)
  AST-2013-002-11.diff uploaded by mmichelson (License 5049)

Modified:
    branches/10/main/http.c

Modified: branches/10/main/http.c
URL: http://svnview.digium.com/svn/asterisk/branches/10/main/http.c?view=diff&rev=383977&r1=383976&r2=383977
==============================================================================
--- branches/10/main/http.c (original)
+++ branches/10/main/http.c Wed Mar 27 09:36:22 2013
@@ -593,6 +593,8 @@
 	AST_RWLIST_UNLOCK(&uris);
 }
 
+#define MAX_POST_CONTENT 1025
+
 /*
  * get post variables from client Request Entity-Body, if content type is
  * application/x-www-form-urlencoded
@@ -622,6 +624,13 @@
 	}
 
 	if (content_length <= 0) {
+		return NULL;
+	}
+
+	if (content_length > MAX_POST_CONTENT - 1) {
+		ast_log(LOG_WARNING, "Excessively long HTTP content. %d is greater than our max of %d\n",
+				content_length, MAX_POST_CONTENT);
+		ast_http_send(ser, AST_HTTP_POST, 413, "Request Entity Too Large", NULL, NULL, 0, 0);
 		return NULL;
 	}