| Summary: | ASTERISK-25742: Secondary IFP Packets can result in accessing uninitialized pointers and a crash | ||||
| Reporter: | Torrey Searle (tsearle) | Labels: | |||
| Date Opened: | 2016-02-03 02:27:29.000-0600 | Date Closed: | 2016-02-03 15:42:42.000-0600 | ||
| Priority: | Major | Regression? | |||
| Status: | Closed/Complete | Components: | Core/UDPTL | ||
| Versions: | 11.22.0 | Frequency of Occurrence | Occasional | ||
| Related Issues: |
| ||||
| Environment: | Attachments: | ( 0) patch | |||
| Description: | upon receiving the following udptl packet
80 12 (sequence number) 07 (primary ifp length) 8A 50 FF 3D 45 3E 5E (primary ifp packet) 52 (2ndary Packet mode) 01 (number of redundant packets) 00 (length) The method decode_open_type will return without setting values for bufs[total_count + i] and lengths[total_count + i] since neither of these arrays were memset to 0, the 0 length packet check on line 392 of udptl.c will fail to skip this packet and instead return a frame to a pointer to a random piece of memory & crashing | ||||
| Comments: | By: Asterisk Team (asteriskteam) 2016-02-03 02:27:31.015-0600 Thanks for creating a report! The issue has entered the triage process. That means the issue will wait in this status until a Bug Marshal has an opportunity to review the issue. Once the issue has been reviewed you will receive comments regarding the next steps towards resolution. A good first step is for you to review the [Asterisk Issue Guidelines|https://wiki.asterisk.org/wiki/display/AST/Asterisk+Issue+Guidelines] if you haven't already. The guidelines detail what is expected from an Asterisk issue report. Then, if you are submitting a patch, please review the [Patch Contribution Process|https://wiki.asterisk.org/wiki/display/AST/Patch+Contribution+Process]. By: Torrey Searle (tsearle) 2016-02-03 02:28:53.525-0600 This patch will ensure that encode_open_type will still set length + buffer pointer in the case of a 0 length packet | ||||