mainThe oSIP library - Support: sr #109131, Heap buffer overflow in...


sr #109131: Heap buffer overflow in `_osip_message_to_str` in libosip2-4.1.0

Submitter:  None
Submitted:  Fri 02 Sep 2016 08:01:25 PM UTC
Category:  None Priority:  5 - Normal
Severity:  6 - Security Status:  Done
Privacy:  Public Assigned to:  aymeric
Originator Email:  -email is unavailable- Open/Closed:  Closed
Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup

Mon 19 Mar 2018 10:35:06 AM UTC, comment #3: 

It's unfortunate but I don't have any copy of the attachement. I guess the problem is on savannah and hope it's temporary.

Aymeric MOIZARD <aymeric>
Group administrator
Sun 18 Mar 2018 05:17:28 PM UTC, comment #2: 

The sip message file #38411 (HARDEN ...) link is broken ...
Can someone please fix the link? Upload the file? Thanks!

Oren <orenosip>
Sat 03 Sep 2016 01:33:17 PM UTC, comment #1: 

fixed in git commit 1d9fb1d.
Tks a lot for report.

Aymeric MOIZARD <aymeric>
Group administrator
Fri 02 Sep 2016 08:01:25 PM UTC, original submission:  

Hi, While fuzzing the torture_test application, I discovered the following bug using afl-fuzz and the patch using an in-house crash triage tool called Orthrus.

Steps to reproduce

$ ./configure --enable-test --disable-shared
$ make -j
$ ./src/test/torture_test <ATTACHED_INPUT> 0 -c

Attached input filename starts with HARDEN


For large SIP messages such as the one attached, the call to _osip_message_to_str overflows the message buffer allocated here:

message = (char *) osip_malloc (SIP_MESSAGE_MAX_LENGTH);

when appending parsed string here:

// After call: strlen(tmp) = 9351 > SIP_MESSAGE_MAX_LENGTH
i = __osip_message_startline_to_str (sip, &tmp);
else {
// Heap allocated buffer message overflows here                                                                       message = osip_str_append (message, tmp);
osip_free (tmp)
message = osip_strn_append (message, CRLF, 2);                                  }

Much later, when message is being reallocated, glibc aborts on detecting the invalid heap metadata around message

// Glibc abort called
if (_osip_message_realloc (&message, dest, header_len + 3, &malloc_size) < 0) {


The attached patch (filename 0001...) fixes this bug by sanitizing (i.e., checking bounds and realloc if necessary) the problematic string append operation.

Security Considerations

The bug can definitely lead to a denial of service for a VoIP application using the affected libosip version (4.1.0). Exploitation is not certain but cannot be ruled out. A CVE is advisable.


  • Bhargava Shastry, SecT, TU Berlin


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #38411:  HARDEN:2842033635,SESSION002:id:000105,sig:06,src:002503+004171,op:splice,rep:32 added by None (10KiB - application/octet-stream - Crashing input and suggested patch)
file #38412:  0001-Patch-1-Fixes-heap-buffer-overflow-in-_osip_message_to_str.patch added by None (588B - text/x-patch - Crashing input and suggested patch)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by orenosip (Posted a comment)
  • -email is unavailable- added by aymeric (Updated the item)
  • -email is unavailable- added by None (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-09-03 aymeric StatusIn Progress Done
        Open/ClosedOpen Closed
    2016-09-03 aymeric StatusNone In Progress
        Assigned toNone aymeric
        Operating SystemGNU/Linux None
    2016-09-02 None Attached File- Added HARDEN:2842033635,SESSION002:id:000105,sig:06,src:002503+004171,op:splice,rep:32, #38411
        Attached File- Added 0001-Patch-1-Fixes-heap-buffer-overflow-in-_osip_message_to_str.patch, #38412

    Back to the top

    Powered by Savane 3.12.
    Corresponding source code