1 Oct
2012
1 Oct
'12
2:19 p.m.
We found a problem regarding TCP connection alias in the following code at
tcp_main.c:
int tcpconn_finish_connect( struct tcp_connection* c,
union sockaddr_union* from)
{
:
:
/* remove all the aliases
except the first one and re-add them
* (there shouldn't be more
then the 3 default aliases at this
* stage) */
for (r=1; r<c->aliases;
r++){
a=&c->con_aliases[r];
tcpconn_listrm(tcpconn_aliases_hash[a->hash],
a, next, prev);
}
c->aliases=1;
As TCP_ALIAS_REPLACE flag is set for the default TCP options value, in the
function _tcpconn_add_alias_unsafe() a TCP connection alias can be moved
from connection A to connection B based on the TCP alias hash. In this
case, the number of aliases is incremented in the connection A, and
decremented from connection B. However, in the connection B the number of
aliases can reach zero (no alias). And the code above can be executed for
connection B setting the number of aliases to 1 unconditionally. When this
case happens, the connection B keeps an invalid alias (already excluded
from connection B by tcpconn_add_alias_unsafe() function called from
connection A). When the connection A is released, the aliases are also
released, and this memory area can be filled with different data. As
connection B has references to an invalid alias it can try to access
invalid areas, and can crash Kamailio. This access happens, for example,
when another alias is added to connection B.
To fix it we include a check before the code:
if (c->aliases>0) {
for (r=1;
r<c->aliases; r++){
a=&c->con_aliases[r];
tcpconn_listrm(tcpconn_aliases_hash[a->hash], a, next, prev);
memset(a,0xbb,sizeof(struct tcp_conn_alias));
}
c->aliases=1;
}
Please let us know if any comments.
Thanks
Jijo