Hi, While fuzzing the torture_test application, I discovered the following bug using afl-fuzz and the patch using an in-house crash triage tool called Orthrus.

Steps to reproduce

$ ./configure --enable-test --disable-shared
$ make -j
$ ./src/test/torture_test <ATTACHED_INPUT> 0 -c

Attached input filename starts with ASAN

Bug

In function osip_body_to_str, the initially computed length for storing stringified SIP body length is incorrect because it does not anticipate the addition of the CRLF characters when body->body->content_type is not NULL:

// Incorrect computation
length = 15 + body->length + (osip_list_size (body->headers) * 40);
tmp_body = (char *) osip_malloc (length);

...
  if ((osip_list_size (body->headers) > 0) || (body->content_type != NULL)) {
// tmp_body may overflow here
    tmp_body = osip_strn_append (tmp_body, CRLF, 2);
  }

where tmp_body holds the stringified SIP body. On detecting the corrupted heap metadata around the overflowed buffer, glibc aborts.

Fix

The attached patch (filename 0001...) fixes this bug by sanitizing (i.e., checking bounds and realloc if necessary) the problematic string append operation.

Security considerations

The bug can definitely lead to a denial of service for a VoIP application using the affected libosip version (4.1.0). Note that the OpenWrt distribution sources this version of libosip2. Exploitation is not certain but cannot be ruled out. A CVE is advisable.

Reporter

• Bhargava Shastry, SecT, TU Berlin