* Fix for buffer overflow in enum_pv_query_3 for char string[17] where the boundary checks for it in is_e164 uses MAX_NUM_LEN.
* Increased the size of MAX_NUM_LEN to 33 to support the maximum number length of 32, which is what we support here on our ISUP links.
Bug: The buffer overflow bug can be triggered by calling enum_pv_query with a number that is to long eg. +1234567890123456789
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/186
-- Commit Summary --
* * Fix for buffer overflow in enum_pv_query_3 for char string[17] where the boundary checks for it in is_e164 uses MAX_NUM_LEN.
-- File Changes --
M modules/enum/enum.c (4)
M modules/enum/enum.h (2)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/186.patchhttps://github.com/kamailio/kamailio/pull/186.diff
---
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/186
Module: kamailio
Branch: master
Commit: 498e225bb52323f92040b8f11223059c06d0dacd
URL: https://github.com/kamailio/kamailio/commit/498e225bb52323f92040b8f11223059…
Author: Daniel-Constantin Mierla <miconda(a)gmail.com>
Committer: Daniel-Constantin Mierla <miconda(a)gmail.com>
Date: 2015-06-03T11:48:28+02:00
Merge pull request #186 from norox/master
enum: fix buffer overflow and increase maximum number length
---
Modified: modules/enum/enum.c
Modified: modules/enum/enum.h
---
Diff: https://github.com/kamailio/kamailio/commit/498e225bb52323f92040b8f11223059…
Patch: https://github.com/kamailio/kamailio/commit/498e225bb52323f92040b8f11223059…
---
diff --git a/modules/enum/enum.c b/modules/enum/enum.c
index 3c21c2f..6439f54 100644
--- a/modules/enum/enum.c
+++ b/modules/enum/enum.c
@@ -34,7 +34,7 @@
* based on the user part of the current Request-URI. These functions
* assume that the Request URI user part consists of an international
* phone number of the form +decimal-digits, where the number of digits is
- * at least 2 and at most 15. Out of this number enum_query forms a domain
+ * at least 2 and at most 32. Out of this number enum_query forms a domain
* name, where the digits are in reverse order and separated by dots
* followed by domain suffix that by default is "e164.arpa.". For example,
* if the user part is +35831234567, the domain name will be
@@ -1005,7 +1005,7 @@ int enum_pv_query_3(struct sip_msg* _msg, char* _sp, char* _suffix,
struct naptr_rdata* naptr;
str pattern, replacement, result, new_result;
str *suffix, *service;
- char string[17];
+ char string[MAX_NUM_LEN];
pv_spec_t *sp;
pv_value_t pv_val;
diff --git a/modules/enum/enum.h b/modules/enum/enum.h
index 838caf6..1f1a509 100644
--- a/modules/enum/enum.h
+++ b/modules/enum/enum.h
@@ -35,7 +35,7 @@
#define MAX_DOMAIN_SIZE 256
-#define MAX_NUM_LEN 22
+#define MAX_NUM_LEN 33
#define MAX_COMPONENT_SIZE (MAX_NUM_LEN * 2) /* separator, apex, ... This simplifies checks */
Module: kamailio
Branch: master
Commit: ca8e6540cd2cd31b63b192a5a3da282eb09b6c94
URL: https://github.com/kamailio/kamailio/commit/ca8e6540cd2cd31b63b192a5a3da282…
Author: Stefan Andersson <stefan.andersson(a)tele2.com>
Committer: Stefan Andersson <stefan.andersson(a)tele2.com>
Date: 2015-06-03T10:54:25+02:00
* Fix for buffer overflow in enum_pv_query_3 for char string[17] where the boundary checks for it in is_e164 uses MAX_NUM_LEN.
* Increased the size of MAX_NUM_LEN to 33 to support the maximum number length of 32, which is what we support here on our ISUP links.
Bug: The buffer overflow bug can be triggered by calling enum_pv_query with a number that is to long eg. +1234567890123456789
---
Modified: modules/enum/enum.c
Modified: modules/enum/enum.h
---
Diff: https://github.com/kamailio/kamailio/commit/ca8e6540cd2cd31b63b192a5a3da282…
Patch: https://github.com/kamailio/kamailio/commit/ca8e6540cd2cd31b63b192a5a3da282…
---
diff --git a/modules/enum/enum.c b/modules/enum/enum.c
index 3c21c2f..6439f54 100644
--- a/modules/enum/enum.c
+++ b/modules/enum/enum.c
@@ -34,7 +34,7 @@
* based on the user part of the current Request-URI. These functions
* assume that the Request URI user part consists of an international
* phone number of the form +decimal-digits, where the number of digits is
- * at least 2 and at most 15. Out of this number enum_query forms a domain
+ * at least 2 and at most 32. Out of this number enum_query forms a domain
* name, where the digits are in reverse order and separated by dots
* followed by domain suffix that by default is "e164.arpa.". For example,
* if the user part is +35831234567, the domain name will be
@@ -1005,7 +1005,7 @@ int enum_pv_query_3(struct sip_msg* _msg, char* _sp, char* _suffix,
struct naptr_rdata* naptr;
str pattern, replacement, result, new_result;
str *suffix, *service;
- char string[17];
+ char string[MAX_NUM_LEN];
pv_spec_t *sp;
pv_value_t pv_val;
diff --git a/modules/enum/enum.h b/modules/enum/enum.h
index 838caf6..1f1a509 100644
--- a/modules/enum/enum.h
+++ b/modules/enum/enum.h
@@ -35,7 +35,7 @@
#define MAX_DOMAIN_SIZE 256
-#define MAX_NUM_LEN 22
+#define MAX_NUM_LEN 33
#define MAX_COMPONENT_SIZE (MAX_NUM_LEN * 2) /* separator, apex, ... This simplifies checks */
Module: kamailio
Branch: master
Commit: 7a33987ab4e74266cd0ccecbe14f7196f97a0f05
URL: https://github.com/kamailio/kamailio/commit/7a33987ab4e74266cd0ccecbe14f719…
Author: Victor Seva <linuxmaniac(a)torreviejawireless.org>
Committer: Victor Seva <linuxmaniac(a)torreviejawireless.org>
Date: 2015-06-03T09:35:51+02:00
tls: fix gcc warnings:
tls_domain.c:507:4: warning: variable âretâ set but not used [-Wunused-but-set-variable]
tls_domain.c:537:4: warning: variable âretâ set but not used [-Wunused-but-set-variable]
tls_domain.c:544:4: warning: variable âretâ set but not used [-Wunused-but-set-variable]
tls_domain.c:576:4: warning: variable âretâ set but not used [-Wunused-but-set-variable]
tls_domain.c:1096:5: warning: variable âretâ set but not used [-Wunused-but-set-variable]
tls_domain.c:1104:4: warning: variable âretâ set but not used [-Wunused-but-set-variable]
tls_domain.c:1111:4: warning: variable âretâ set but not used [-Wunused-but-set-variable]
tls_server.c:222:3: warning: variable âretâ set but not used [-Wunused-but-set-variable]
tls_server.c:565:4: warning: variable âretâ set but not used [-Wunused-but-set-variable]
tls_server.c:843:5: warning: variable âretâ set but not used [-Wunused-but-set-variable]
tls_server.c:877:5: warning: variable âretâ set but not used [-Wunused-but-set-variable]
tls_server.c:1231:4: warning: variable âretâ set but not used [-Wunused-but-set-variable]
tls_server.c:1265:4: warning: variable âretâ set but not used [-Wunused-but-set-variable]
---
Modified: modules/tls/tls_util.h
---
Diff: https://github.com/kamailio/kamailio/commit/7a33987ab4e74266cd0ccecbe14f719…
Patch: https://github.com/kamailio/kamailio/commit/7a33987ab4e74266cd0ccecbe14f719…
---
diff --git a/modules/tls/tls_util.h b/modules/tls/tls_util.h
index efbd842..6fe91a2 100644
--- a/modules/tls/tls_util.h
+++ b/modules/tls/tls_util.h
@@ -31,26 +31,29 @@
#include "../../str.h"
#include "tls_domain.h"
+static inline int tls_err_ret(char *s, tls_domains_cfg_t **tls_domains_cfg) {
+ long err;
+ int ret = 0;
+ if ((*tls_domains_cfg)->srv_default->ctx &&
+ (*tls_domains_cfg)->srv_default->ctx[0])
+ {
+ while((err = ERR_get_error())) {
+ ret = 1;
+ ERR("%s%s\n", s ? s : "", ERR_error_string(err, 0));
+ }
+ }
+ return ret;
+}
-#define TLS_ERR_RET(r, s) \
-do { \
- long err; \
- (r) = 0; \
- if ((*tls_domains_cfg)->srv_default->ctx && \
- (*tls_domains_cfg)->srv_default->ctx[0]) { \
- while((err = ERR_get_error())) { \
- (r) = 1; \
- ERR("%s%s\n", ((s)) ? (s) : "", \
- ERR_error_string(err, 0)); \
- } \
- } \
+#define TLS_ERR_RET(r, s) \
+do { \
+ (r) = tls_err_ret((s), tls_domains_cfg); \
} while(0)
-#define TLS_ERR(s) \
-do { \
- int ret; \
- TLS_ERR_RET(ret, s); \
+#define TLS_ERR(s) \
+do { \
+ tls_err_ret((s), tls_domains_cfg); \
} while(0)