<p>Richard Mudgett <strong>merged</strong> this change.</p><p><a href="https://gerrit.asterisk.org/10221">View Change</a></p><div style="white-space:pre-wrap">Approvals:
Sean Bright: Looks good to me, but someone else must approve
Jenkins2: Verified
Richard Mudgett: Looks good to me, approved; Approved for Submit
</div><pre style="font-family: monospace,monospace; white-space: pre-wrap;">AST-2018-009: Fix crash processing websocket HTTP Upgrade requests<br><br>The HTTP request processing in res_http_websocket allocates additional<br>space on the stack for various headers received during an Upgrade request.<br>An attacker could send a specially crafted request that causes this code<br>to overflow the stack, resulting in a crash.<br><br>* No longer allocate memory from the stack in a loop to parse the header<br>values. NOTE: There is a slight API change when using the passed in<br>strings as is. We now require the passed in strings to no longer have<br>leading or trailing whitespace. This isn't a problem as the only callers<br>have already done this before passing the strings to the affected<br>function.<br><br>ASTERISK-28013 #close<br><br>Change-Id: Ia564825a8a95e085fd17e658cb777fe1afa8091a<br>---<br>M res/res_http_websocket.c<br>1 file changed, 14 insertions(+), 11 deletions(-)<br><br></pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;"><span>diff --git a/res/res_http_websocket.c b/res/res_http_websocket.c</span><br><span>index 440bf41..0ff876b 100644</span><br><span>--- a/res/res_http_websocket.c</span><br><span>+++ b/res/res_http_websocket.c</span><br><span>@@ -736,7 +736,8 @@</span><br><span> int AST_OPTIONAL_API_NAME(ast_websocket_uri_cb)(struct ast_tcptls_session_instance *ser, const struct ast_http_uri *urih, const char *uri, enum ast_http_method method, struct ast_variable *get_vars, struct ast_variable *headers)</span><br><span> {</span><br><span> struct ast_variable *v;</span><br><span style="color: hsl(0, 100%, 40%);">- char *upgrade = NULL, *key = NULL, *key1 = NULL, *key2 = NULL, *protos = NULL, *requested_protocols = NULL, *protocol = NULL;</span><br><span style="color: hsl(120, 100%, 40%);">+ const char *upgrade = NULL, *key = NULL, *key1 = NULL, *key2 = NULL, *protos = NULL;</span><br><span style="color: hsl(120, 100%, 40%);">+ char *requested_protocols = NULL, *protocol = NULL;</span><br><span> int version = 0, flags = 1;</span><br><span> struct ast_websocket_protocol *protocol_handler = NULL;</span><br><span> struct ast_websocket *session;</span><br><span>@@ -755,16 +756,15 @@</span><br><span> /* Get the minimum headers required to satisfy our needs */</span><br><span> for (v = headers; v; v = v->next) {</span><br><span> if (!strcasecmp(v->name, "Upgrade")) {</span><br><span style="color: hsl(0, 100%, 40%);">- upgrade = ast_strip(ast_strdupa(v->value));</span><br><span style="color: hsl(120, 100%, 40%);">+ upgrade = v->value;</span><br><span> } else if (!strcasecmp(v->name, "Sec-WebSocket-Key")) {</span><br><span style="color: hsl(0, 100%, 40%);">- key = ast_strip(ast_strdupa(v->value));</span><br><span style="color: hsl(120, 100%, 40%);">+ key = v->value;</span><br><span> } else if (!strcasecmp(v->name, "Sec-WebSocket-Key1")) {</span><br><span style="color: hsl(0, 100%, 40%);">- key1 = ast_strip(ast_strdupa(v->value));</span><br><span style="color: hsl(120, 100%, 40%);">+ key1 = v->value;</span><br><span> } else if (!strcasecmp(v->name, "Sec-WebSocket-Key2")) {</span><br><span style="color: hsl(0, 100%, 40%);">- key2 = ast_strip(ast_strdupa(v->value));</span><br><span style="color: hsl(120, 100%, 40%);">+ key2 = v->value;</span><br><span> } else if (!strcasecmp(v->name, "Sec-WebSocket-Protocol")) {</span><br><span style="color: hsl(0, 100%, 40%);">- requested_protocols = ast_strip(ast_strdupa(v->value));</span><br><span style="color: hsl(0, 100%, 40%);">- protos = ast_strdupa(requested_protocols);</span><br><span style="color: hsl(120, 100%, 40%);">+ protos = v->value;</span><br><span> } else if (!strcasecmp(v->name, "Sec-WebSocket-Version")) {</span><br><span> if (sscanf(v->value, "%30d", &version) != 1) {</span><br><span> version = 0;</span><br><span>@@ -778,7 +778,7 @@</span><br><span> ast_sockaddr_stringify(&ser->remote_address));</span><br><span> ast_http_error(ser, 426, "Upgrade Required", NULL);</span><br><span> return 0;</span><br><span style="color: hsl(0, 100%, 40%);">- } else if (ast_strlen_zero(requested_protocols)) {</span><br><span style="color: hsl(120, 100%, 40%);">+ } else if (ast_strlen_zero(protos)) {</span><br><span> /* If there's only a single protocol registered, and the</span><br><span> * client doesn't specify what protocol it's using, go ahead</span><br><span> * and accept the connection */</span><br><span>@@ -799,9 +799,12 @@</span><br><span> return 0;</span><br><span> }</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- /* Iterate through the requested protocols trying to find one that we have a handler for */</span><br><span style="color: hsl(0, 100%, 40%);">- while (!protocol_handler && (protocol = strsep(&requested_protocols, ","))) {</span><br><span style="color: hsl(0, 100%, 40%);">- protocol_handler = ao2_find(server->protocols, ast_strip(protocol), OBJ_KEY);</span><br><span style="color: hsl(120, 100%, 40%);">+ if (!protocol_handler && protos) {</span><br><span style="color: hsl(120, 100%, 40%);">+ requested_protocols = ast_strdupa(protos);</span><br><span style="color: hsl(120, 100%, 40%);">+ /* Iterate through the requested protocols trying to find one that we have a handler for */</span><br><span style="color: hsl(120, 100%, 40%);">+ while (!protocol_handler && (protocol = strsep(&requested_protocols, ","))) {</span><br><span style="color: hsl(120, 100%, 40%);">+ protocol_handler = ao2_find(server->protocols, ast_strip(protocol), OBJ_KEY);</span><br><span style="color: hsl(120, 100%, 40%);">+ }</span><br><span> }</span><br><span> </span><br><span> /* If no protocol handler exists bump this back to the requester */</span><br><span></span><br></pre><p>To view, visit <a href="https://gerrit.asterisk.org/10221">change 10221</a>. To unsubscribe, or for help writing mail filters, visit <a href="https://gerrit.asterisk.org/settings">settings</a>.</p><div itemscope itemtype="http://schema.org/EmailMessage"><div itemscope itemprop="action" itemtype="http://schema.org/ViewAction"><link itemprop="url" href="https://gerrit.asterisk.org/10221"/><meta itemprop="name" content="View Change"/></div></div>
<div style="display:none"> Gerrit-Project: asterisk </div>
<div style="display:none"> Gerrit-Branch: 13.23 </div>
<div style="display:none"> Gerrit-MessageType: merged </div>
<div style="display:none"> Gerrit-Change-Id: Ia564825a8a95e085fd17e658cb777fe1afa8091a </div>
<div style="display:none"> Gerrit-Change-Number: 10221 </div>
<div style="display:none"> Gerrit-PatchSet: 1 </div>
<div style="display:none"> Gerrit-Owner: Richard Mudgett <rmudgett@digium.com> </div>
<div style="display:none"> Gerrit-Reviewer: Jenkins2 </div>
<div style="display:none"> Gerrit-Reviewer: Richard Mudgett <rmudgett@digium.com> </div>
<div style="display:none"> Gerrit-Reviewer: Sean Bright <sean.bright@gmail.com> </div>