helpThe oSIP library - Support: sr #109131, Heap buffer overflow in...

 
 

sr #109131: Heap buffer overflow in `_osip_message_to_str` in libosip2-4.1.0

Submitted by:  None
Submitted on:  Fri 02 Sep 2016 08:01:25 PM UTC  
 
Category:  None Priority:  5 - Normal
Severity:  6 - Security Status:  Done
Privacy:  Public Assigned to:  Aymeric MOIZARD <aymeric>
Originator Email:  -email is unavailable- Open/Closed:  Closed
Operating System:  None

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 19 Mar 2018 10:35:06 AM UTC, comment #3: 

It's unfortunate but I don't have any copy of the attachement. I guess the problem is on savannah and hope it's temporary.
Aymeric

Aymeric MOIZARD <aymeric>
Project AdministratorIn charge of this item.
Sun 18 Mar 2018 05:17:28 PM UTC, comment #2: 

Hi,
The sip message file #38411 (HARDEN ...) link is broken ...
Can someone please fix the link? Upload the file? Thanks!

Oren <orenosip>
Sat 03 Sep 2016 01:33:17 PM UTC, comment #1: 

fixed in git commit 1d9fb1d.
Tks a lot for report.

Aymeric MOIZARD <aymeric>
Project AdministratorIn charge of this item.
Fri 02 Sep 2016 08:01:25 PM UTC, original submission:  

Hi, While fuzzing the torture_test application, I discovered the following bug using afl-fuzz and the patch using an in-house crash triage tool called Orthrus.

Steps to reproduce

$ ./configure --enable-test --disable-shared
$ make -j
$ ./src/test/torture_test <ATTACHED_INPUT> 0 -c

Attached input filename starts with HARDEN

Bug

For large SIP messages such as the one attached, the call to _osip_message_to_str overflows the message buffer allocated here:

// SIP_MESSAGE_MAX_LENGTH = 8000
message = (char *) osip_malloc (SIP_MESSAGE_MAX_LENGTH);

when appending parsed string here:

// After call: strlen(tmp) = 9351 > SIP_MESSAGE_MAX_LENGTH
i = __osip_message_startline_to_str (sip, &tmp);
...
else {
// Heap allocated buffer message overflows here                                                                       message = osip_str_append (message, tmp);
osip_free (tmp)
message = osip_strn_append (message, CRLF, 2);                                  }

Much later, when message is being reallocated, glibc aborts on detecting the invalid heap metadata around message

// Glibc abort called
if (_osip_message_realloc (&message, dest, header_len + 3, &malloc_size) < 0) {
...

Fix

The attached patch (filename 0001...) fixes this bug by sanitizing (i.e., checking bounds and realloc if necessary) the problematic string append operation.

Security Considerations

The bug can definitely lead to a denial of service for a VoIP application using the affected libosip version (4.1.0). Exploitation is not certain but cannot be ruled out. A CVE is advisable.

Reporter

  • Bhargava Shastry, SecT, TU Berlin
Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #38411:  HARDEN:2842033635,SESSION002:id:000105,sig:06,src:002503+004171,op:splice,rep:32 added by None (10KiB - application/octet-stream - Crashing input and suggested patch)
file #38412:  0001-Patch-1-Fixes-heap-buffer-overflow-in-_osip_message_to_str.patch added by None (588B - text/x-patch - Crashing input and suggested patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by orenosip (Posted a comment)
  • -email is unavailable- added by aymeric (Updated the item)
  • -email is unavailable- added by None (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-09-03 aymeric StatusIn Progress => Done
        Open/ClosedOpen => Closed
    2016-09-03 aymeric StatusNone => In Progress
        Assigned toNone => aymeric
        Operating SystemGNU/Linux => None
    2016-09-02 None Attached File- => Added HARDEN:2842033635,SESSION002:id:000105,sig:06,src:002503+004171,op:splice,rep:32, #38411
        Attached File- => Added 0001-Patch-1-Fixes-heap-buffer-overflow-in-_osip_message_to_str.patch, #38412

    Back to the top


    Powered by Savane 3.5