mainThe oSIP library - Support: sr #109302, Heap buffer corruption in...

 
 

sr #109302: Heap buffer corruption in sdp_message_clone()

Submitter:  None
Submitted:  Wed 26 Apr 2017 04:13:16 PM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  6 - Security Status:  Invalid
Privacy:  Public Assigned to:  aymeric
Originator Email:  -email is unavailable- Open/Closed:  Closed
Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 03 May 2017 09:25:16 AM UTC, comment #2: 

Was a false positive according to author.
Closed.

Aymeric MOIZARD <aymeric>
Group administrator
Thu 27 Apr 2017 01:45:08 PM UTC, comment #1: 

Hi!

I'm sorry, but running against both 4.1.0 and latest git didn't crashed the torture.c file.

With old version, I tried:
./src/test/.libs/torture_test ~/sdp_1.txt 0 -c
./src/test/.libs/torture_test ~/sdp_1.txt 0 -b -c
./src/test/.libs/torture_test ~/sdp_2.txt 0 -c
./src/test/.libs/torture_test ~/sdp_2.txt 0 -b -c
...

With new version, I tried:
./src/test/torture_test ~/sdp_1.txt -v -c
./src/test/torture_test ~/sdp_2.txt -v -c
...

Note that with old version, "-b" should be required to test the real message, otherwise the file and real parsed string different. (the read() don't understand \0 or special chars)

Could you please send the backtrace?
Any additionnal details? May be a fix and explanation on the error?
If you could convert the sdp*.txt so it can produce the crash also with "-b", that would be better.

In the future, please use "-b" otherwise, you don't test the real file.

Aymeric MOIZARD <aymeric>
Group administrator
Wed 26 Apr 2017 04:13:16 PM UTC, original submission:  

Hi,

Using the following lines in `torture.c` and testing the SDP message clone implementation, I found a couple of crashes in v4.1.0 possibly carried over to v5.0.0. Could you please check them out?

```C
#if 1
      sdp_message_t *sdp;
      osip_body_t *oldbody;
      int pos;

      pos = 0;
      while (!osip_list_eol (&sip->bodies, pos)) {
        oldbody = (osip_body_t *) osip_list_get (&sip->bodies, pos);
        pos++;
        sdp_message_init (&sdp);
        i = sdp_message_parse (sdp, oldbody->body);
        if (i != 0) {
          fprintf (stdout, "ERROR: Bad SDP!\n");
        }
        else
          fprintf (stdout, "SUCCESS: Correct SDP!\n");
        if (clone) {
            sdp_message_t *copy;
            i = sdp_message_clone (sdp, &copy);

            if (i < 0)
                    goto sdp_err;
            else
                    sdp_message_free(copy);
        }
sdp_err:
        sdp_message_free (sdp);
        sdp = NULL;
      }
#endif
```

The crashing inputs have been attached with this bug report. You can invoke them as usual like so `torture_test <FILE> -c`

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #40513:  sdp_1.txt added by None (10KiB - text/plain - SDP messages that cause the crash)
file #40514:  sdp_2.txt added by None (9KiB - text/plain - SDP messages that cause the crash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by aymeric (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-05-03 aymeric StatusWorks For Me Invalid
        Open/ClosedOpen Closed
    2017-04-27 aymeric StatusNone Works For Me
        Assigned toNone aymeric
    2017-04-26 None Attached File- Added sdp_1.txt, #40513
        Attached File- Added sdp_2.txt, #40514

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code