From cd904c43ae59e322b4d62d44d849a5006df60035 Mon Sep 17 00:00:00 2001
From: Corey Farrell <git@cfware.com>
Date: Sat, 1 Jul 2017 20:24:27 -0400
Subject: [PATCH 1/2] core: Add ast_safe_execvp function.

This gives modules the ability to run external commands with greater
safety compared to ast_safe_system.  Specifically when some parameters
are filled by untrusted sources the new function does not allow
malicious input to break argument encoding.  This may be of particular
concern where CALLERID might be used as a parameter to a script run by
ast_safe_system, could potentially allow arbitrary code execution.

ASTERISK-27103

Change-Id: I7552472247a84cde24e1358aaf64af160107aef1
---
 include/asterisk/app.h |   5 +++
 main/asterisk.c        | 101 ++++++++++++++++++++++++++++++++++++++++---------
 2 files changed, 88 insertions(+), 18 deletions(-)

diff --git a/include/asterisk/app.h b/include/asterisk/app.h
index 86336e3..aeb1715 100644
--- a/include/asterisk/app.h
+++ b/include/asterisk/app.h
@@ -872,6 +872,11 @@ int ast_vm_test_create_user(const char *context, const char *mailbox);
 #endif
 
 /*! \brief Safely spawn an external program while closing file descriptors
+	\note This replaces the \b execvp call in all Asterisk modules
+*/
+int ast_safe_execvp(int dualfork, const char *file, char *const argv[]);
+
+/*! \brief Safely spawn an external program while closing file descriptors
 	\note This replaces the \b system call in all Asterisk modules
 */
 int ast_safe_system(const char *s);
diff --git a/main/asterisk.c b/main/asterisk.c
index e256276..0ef0ff9 100644
--- a/main/asterisk.c
+++ b/main/asterisk.c
@@ -1283,11 +1283,10 @@ void ast_unreplace_sigchld(void)
 	ast_mutex_unlock(&safe_system_lock);
 }
 
-int ast_safe_system(const char *s)
+/*! \brief fork and perform other preparations for spawning applications */
+static pid_t safe_exec_prep(int dualfork)
 {
 	pid_t pid;
-	int res;
-	int status;
 
 #if defined(HAVE_WORKING_FORK) || defined(HAVE_WORKING_VFORK)
 	ast_replace_sigchld();
@@ -1309,35 +1308,101 @@ int ast_safe_system(const char *s)
 		cap_free(cap);
 #endif
 #ifdef HAVE_WORKING_FORK
-		if (ast_opt_high_priority)
+		if (ast_opt_high_priority) {
 			ast_set_priority(0);
+		}
 		/* Close file descriptors and launch system command */
 		ast_close_fds_above_n(STDERR_FILENO);
 #endif
-		execl("/bin/sh", "/bin/sh", "-c", s, (char *) NULL);
-		_exit(1);
-	} else if (pid > 0) {
-		for (;;) {
-			res = waitpid(pid, &status, 0);
-			if (res > -1) {
-				res = WIFEXITED(status) ? WEXITSTATUS(status) : -1;
-				break;
-			} else if (errno != EINTR)
-				break;
+		if (dualfork) {
+#ifdef HAVE_WORKING_FORK
+			pid = fork();
+#else
+			pid = vfork();
+#endif
+			if (pid < 0) {
+				/* Second fork failed. */
+				/* No logger available. */
+				_exit(1);
+			}
+
+			if (pid > 0) {
+				/* This is the first fork, exit so the reaper finishes right away. */
+				_exit(0);
+			}
+
+			/* This is the second fork.  The first fork will exit immediately so
+			 * Asterisk doesn't have to wait for completion.
+			 * ast_safe_system("cmd &") would run in the background, but the '&'
+			 * cannot be added with ast_safe_execvp, so we have to double fork.
+			 */
 		}
-	} else {
+	}
+
+	if (pid < 0) {
 		ast_log(LOG_WARNING, "Fork failed: %s\n", strerror(errno));
-		res = -1;
+	}
+#else
+	ast_log(LOG_WARNING, "Fork failed: %s\n", strerror(ENOTSUP));
+	pid = -1;
+#endif
+
+	return pid;
+}
+
+/*! \brief wait for spawned application to complete and unreplace sigchld */
+static int safe_exec_wait(pid_t pid)
+{
+	int res = -1;
+
+#if defined(HAVE_WORKING_FORK) || defined(HAVE_WORKING_VFORK)
+	while (pid > 0) {
+		int status;
+
+		res = waitpid(pid, &status, 0);
+
+		if (res > -1) {
+			res = WIFEXITED(status) ? WEXITSTATUS(status) : -1;
+			break;
+		}
+
+		if (errno != EINTR) {
+			break;
+		}
 	}
 
 	ast_unreplace_sigchld();
-#else /* !defined(HAVE_WORKING_FORK) && !defined(HAVE_WORKING_VFORK) */
-	res = -1;
 #endif
 
 	return res;
 }
 
+int ast_safe_execvp(int dualfork, const char *file, char *const argv[])
+{
+	pid_t pid = safe_exec_prep(dualfork);
+
+	if (pid == 0) {
+		execvp(file, argv);
+		_exit(1);
+		/* noreturn from _exit */
+	}
+
+	return safe_exec_wait(pid);
+}
+
+int ast_safe_system(const char *s)
+{
+	pid_t pid = safe_exec_prep(0);
+
+	if (pid == 0) {
+		execl("/bin/sh", "/bin/sh", "-c", s, (char *) NULL);
+		_exit(1);
+		/* noreturn from _exit */
+	}
+
+	return safe_exec_wait(pid);
+}
+
 /*!
  * \brief enable or disable a logging level to a specified console
  */
-- 
2.9.4