git.ipfire.org Git - thirdparty/asterisk.git/blob

   1 From aefc5f83f7de651e3a37e7e1781bfaef46dab9c4 Mon Sep 17 00:00:00 2001
   2 From: Ben Ford <bford@sangoma.com>
   3 Date: Wed, 30 Nov 2022 11:28:16 -0600
   4 Subject: [PATCH] Merge pull request from GHSA-fq45-m3f7-3mhj
   5
   6 * Initial patch
   7
   8 * Use 'pj_scan_is_eof(scanner)'
   9
  10 Co-authored-by: Aaron Lichtman <aaronlichtman@gmail.com>
  11
  12 * Use 'pj_scan_is_eof(scanner)'
  13
  14 Co-authored-by: Aaron Lichtman <aaronlichtman@gmail.com>
  15
  16 * Use 'pj_scan_is_eof(scanner)'
  17
  18 Co-authored-by: Aaron Lichtman <aaronlichtman@gmail.com>
  19
  20 * Use `!pj_scan_is_eof` instead of manually checking `scanner->curptr < scanner->end`
  21
  22 Co-authored-by: Maksim Mukosey <mmukosey@gmail.com>
  23
  24 * Update pjlib-util/src/pjlib-util/scanner.c
  25
  26 Co-authored-by: Aaron Lichtman <aaronlichtman@gmail.com>
  27
  28 * Update pjlib-util/src/pjlib-util/scanner.c
  29
  30 Co-authored-by: Aaron Lichtman <aaronlichtman@gmail.com>
  31
  32 * Update pjlib-util/src/pjlib-util/scanner.c
  33
  34 Co-authored-by: Aaron Lichtman <aaronlichtman@gmail.com>
  35
  36 * Revert '>=' back to '>' in pj_scan_stricmp_alnum()
  37
  38 * Fix error compiles.
  39
  40 Co-authered-by: sauwming <ming@teluu.com>
  41 Co-authored-by: Nanang Izzuddin <nanang@teluu.com>
  42 Co-authored-by: Aaron Lichtman <aaronlichtman@gmail.com>
  43 Co-authored-by: Maksim Mukosey <mmukosey@gmail.com>
  44 ---
  45  pjlib-util/src/pjlib-util/scanner.c | 41 +++++++++++++++++++----------
  46  pjmedia/src/pjmedia/rtp.c           | 11 +++++---
  47  pjmedia/src/pjmedia/sdp.c           | 24 ++++++++++-------
  48  3 files changed, 48 insertions(+), 28 deletions(-)
  49
  50 diff --git a/pjlib-util/src/pjlib-util/scanner.c b/pjlib-util/src/pjlib-util/scanner.c
  51 index c18b74c55..ea27bbec9 100644
  52 --- a/pjlib-util/src/pjlib-util/scanner.c
  53 +++ b/pjlib-util/src/pjlib-util/scanner.c
  54 @@ -195,7 +195,13 @@ PJ_DEF(void) pj_scan_skip_whitespace( pj_scanner *scanner )
  55
  56  PJ_DEF(void) pj_scan_skip_line( pj_scanner *scanner )
  57  {
  58 -    char *s = pj_ansi_strchr(scanner->curptr, '\n');
  59 +    char *s;
  60 +
  61 +    if (pj_scan_is_eof(scanner)) {
  62 +        return;
  63 +    }
  64 +
  65 +    s = pj_memchr(scanner->curptr, '\n', scanner->end - scanner->curptr);
  66      if (!s) {
  67         scanner->curptr = scanner->end;
  68      } else {
  69 @@ -264,8 +270,7 @@ PJ_DEF(void) pj_scan_get( pj_scanner *scanner,
  70
  71      pj_assert(pj_cis_match(spec,0)==0);
  72
  73 -    /* EOF is detected implicitly */
  74 -    if (!pj_cis_match(spec, *s)) {
  75 +    if (pj_scan_is_eof(scanner) || !pj_cis_match(spec, *s)) {
  76         pj_scan_syntax_err(scanner);
  77         return;
  78      }
  79 @@ -299,8 +304,7 @@ PJ_DEF(void) pj_scan_get_unescape( pj_scanner *scanner,
  80      /* Must not match character '%' */
  81      pj_assert(pj_cis_match(spec,'%')==0);
  82
  83 -    /* EOF is detected implicitly */
  84 -    if (!pj_cis_match(spec, *s) && *s != '%') {
  85 +    if (pj_scan_is_eof(scanner) || !pj_cis_match(spec, *s) && *s != '%') {
  86         pj_scan_syntax_err(scanner);
  87         return;
  88      }
  89 @@ -436,7 +440,9 @@ PJ_DEF(void) pj_scan_get_n( pj_scanner *scanner,
  90
  91      scanner->curptr += N;
  92
  93 -    if (PJ_SCAN_IS_PROBABLY_SPACE(*scanner->curptr) && scanner->skip_ws) {
  94 +    if (!pj_scan_is_eof(scanner) &&
  95 +       PJ_SCAN_IS_PROBABLY_SPACE(*scanner->curptr) && scanner->skip_ws)
  96 +    {
  97         pj_scan_skip_whitespace(scanner);
  98      }
  99  }
 100 @@ -462,15 +468,16 @@ PJ_DEF(int) pj_scan_get_char( pj_scanner *scanner )
 101
 102  PJ_DEF(void) pj_scan_get_newline( pj_scanner *scanner )
 103  {
 104 -    if (!PJ_SCAN_IS_NEWLINE(*scanner->curptr)) {
 105 +    if (pj_scan_is_eof(scanner) || !PJ_SCAN_IS_NEWLINE(*scanner->curptr)) {
 106         pj_scan_syntax_err(scanner);
 107         return;
 108      }
 109
 110 +    /* We have checked scanner->curptr validity above */
 111      if (*scanner->curptr == '\r') {
 112         ++scanner->curptr;
 113      }
 114 -    if (*scanner->curptr == '\n') {
 115 +    if (!pj_scan_is_eof(scanner) && *scanner->curptr == '\n') {
 116         ++scanner->curptr;
 117      }
 118
 119 @@ -515,7 +522,9 @@ PJ_DEF(void) pj_scan_get_until( pj_scanner *scanner,
 120
 121      scanner->curptr = s;
 122
 123 -    if (PJ_SCAN_IS_PROBABLY_SPACE(*s) && scanner->skip_ws) {
 124 +    if (!pj_scan_is_eof(scanner) && PJ_SCAN_IS_PROBABLY_SPACE(*s) &&
 125 +       scanner->skip_ws)
 126 +    {
 127         pj_scan_skip_whitespace(scanner);
 128      }
 129  }
 130 @@ -539,7 +548,9 @@ PJ_DEF(void) pj_scan_get_until_ch( pj_scanner *scanner,
 131
 132      scanner->curptr = s;
 133
 134 -    if (PJ_SCAN_IS_PROBABLY_SPACE(*s) && scanner->skip_ws) {
 135 +    if (!pj_scan_is_eof(scanner) && PJ_SCAN_IS_PROBABLY_SPACE(*s) &&
 136 +       scanner->skip_ws)
 137 +    {
 138         pj_scan_skip_whitespace(scanner);
 139      }
 140  }
 141 @@ -565,7 +576,9 @@ PJ_DEF(void) pj_scan_get_until_chr( pj_scanner *scanner,
 142
 143      scanner->curptr = s;
 144
 145 -    if (PJ_SCAN_IS_PROBABLY_SPACE(*s) && scanner->skip_ws) {
 146 +    if (!pj_scan_is_eof(scanner) && PJ_SCAN_IS_PROBABLY_SPACE(*s) &&
 147 +       scanner->skip_ws)
 148 +    {
 149         pj_scan_skip_whitespace(scanner);
 150      }
 151  }
 152 @@ -580,7 +593,9 @@ PJ_DEF(void) pj_scan_advance_n( pj_scanner *scanner,
 153
 154      scanner->curptr += N;
 155
 156 -    if (PJ_SCAN_IS_PROBABLY_SPACE(*scanner->curptr) && skip_ws) {
 157 +    if (!pj_scan_is_eof(scanner) &&
 158 +       PJ_SCAN_IS_PROBABLY_SPACE(*scanner->curptr) && skip_ws)
 159 +    {
 160         pj_scan_skip_whitespace(scanner);
 161      }
 162  }
 163 @@ -631,5 +646,3 @@ PJ_DEF(void) pj_scan_restore_state( pj_scanner *scanner,
 164      scanner->line = state->line;
 165      scanner->start_line = state->start_line;
 166  }
 167 -
 168 -
 169 diff --git a/pjmedia/src/pjmedia/rtp.c b/pjmedia/src/pjmedia/rtp.c
 170 index 6c571010c..c987cd0ad 100644
 171 --- a/pjmedia/src/pjmedia/rtp.c
 172 +++ b/pjmedia/src/pjmedia/rtp.c
 173 @@ -183,6 +183,11 @@ PJ_DEF(pj_status_t) pjmedia_rtp_decode_rtp2(
 174      /* Payload is located right after header plus CSRC */
 175      offset = sizeof(pjmedia_rtp_hdr) + ((*hdr)->cc * sizeof(pj_uint32_t));
 176
 177 +    /* Check that offset is less than packet size */
 178 +    if (offset >= pkt_len) {
 179 +        return PJMEDIA_RTP_EINLEN;
 180 +    }
 181 +
 182      /* Decode RTP extension. */
 183      if ((*hdr)->x) {
 184          dec_hdr->ext_hdr = (pjmedia_rtp_ext_hdr*)(((pj_uint8_t*)pkt) + offset);
 185 @@ -195,8 +200,8 @@ PJ_DEF(pj_status_t) pjmedia_rtp_decode_rtp2(
 186         dec_hdr->ext_len = 0;
 187      }
 188
 189 -    /* Check that offset is less than packet size */
 190 -    if (offset > pkt_len)
 191 +    /* Check again that offset is still less than packet size */
 192 +    if (offset >= pkt_len)
 193         return PJMEDIA_RTP_EINLEN;
 194
 195      /* Find and set payload. */
 196 @@ -386,5 +391,3 @@ void pjmedia_rtp_seq_update( pjmedia_rtp_seq_session *sess,
 197         seq_status->status.value = st.status.value;
 198      }
 199  }
 200 -
 201 -
 202 diff --git a/pjmedia/src/pjmedia/sdp.c b/pjmedia/src/pjmedia/sdp.c
 203 index c443d863f..f27a1a84f 100644
 204 --- a/pjmedia/src/pjmedia/sdp.c
 205 +++ b/pjmedia/src/pjmedia/sdp.c
 206 @@ -967,13 +967,13 @@ static void parse_version(pj_scanner *scanner, parse_context *ctx)
 207      ctx->last_error = PJMEDIA_SDP_EINVER;
 208
 209      /* check equal sign */
 210 -    if (*(scanner->curptr+1) != '=') {
 211 +    if (scanner->curptr+1 >= scanner->end || *(scanner->curptr+1) != '=') {
 212         on_scanner_error(scanner);
 213         return;
 214      }
 215
 216      /* check version is 0 */
 217 -    if (*(scanner->curptr+2) != '0') {
 218 +    if (scanner->curptr+2 >= scanner->end || *(scanner->curptr+2) != '0') {
 219         on_scanner_error(scanner);
 220         return;
 221      }
 222 @@ -990,7 +990,7 @@ static void parse_origin(pj_scanner *scanner, pjmedia_sdp_session *ses,
 223      ctx->last_error = PJMEDIA_SDP_EINORIGIN;
 224
 225      /* check equal sign */
 226 -    if (*(scanner->curptr+1) != '=') {
 227 +    if (scanner->curptr+1 >= scanner->end || *(scanner->curptr+1) != '=') {
 228         on_scanner_error(scanner);
 229         return;
 230      }
 231 @@ -1036,7 +1036,7 @@ static void parse_time(pj_scanner *scanner, pjmedia_sdp_session *ses,
 232      ctx->last_error = PJMEDIA_SDP_EINTIME;
 233
 234      /* check equal sign */
 235 -    if (*(scanner->curptr+1) != '=') {
 236 +    if (scanner->curptr+1 >= scanner->end || *(scanner->curptr+1) != '=') {
 237         on_scanner_error(scanner);
 238         return;
 239      }
 240 @@ -1064,7 +1064,7 @@ static void parse_generic_line(pj_scanner *scanner, pj_str_t *str,
 241      ctx->last_error = PJMEDIA_SDP_EINSDP;
 242
 243      /* check equal sign */
 244 -    if (*(scanner->curptr+1) != '=') {
 245 +    if ((scanner->curptr+1 >= scanner->end) || *(scanner->curptr+1) != '=') {
 246         on_scanner_error(scanner);
 247         return;
 248      }
 249 @@ -1133,7 +1133,7 @@ static void parse_media(pj_scanner *scanner, pjmedia_sdp_media *med,
 250      ctx->last_error = PJMEDIA_SDP_EINMEDIA;
 251
 252      /* check the equal sign */
 253 -    if (*(scanner->curptr+1) != '=') {
 254 +    if (scanner->curptr+1 >= scanner->end || *(scanner->curptr+1) != '=') {
 255         on_scanner_error(scanner);
 256         return;
 257      }
 258 @@ -1148,6 +1148,10 @@ static void parse_media(pj_scanner *scanner, pjmedia_sdp_media *med,
 259      /* port */
 260      pj_scan_get(scanner, &cs_token, &str);
 261      med->desc.port = (unsigned short)pj_strtoul(&str);
 262 +    if (pj_scan_is_eof(scanner)) {
 263 +        on_scanner_error(scanner);
 264 +        return;
 265 +    }
 266      if (*scanner->curptr == '/') {
 267         /* port count */
 268         pj_scan_get_char(scanner);
 269 @@ -1159,7 +1163,7 @@ static void parse_media(pj_scanner *scanner, pjmedia_sdp_media *med,
 270      }
 271
 272      if (pj_scan_get_char(scanner) != ' ') {
 273 -       PJ_THROW(SYNTAX_ERROR);
 274 +       on_scanner_error(scanner);
 275      }
 276
 277      /* transport */
 278 @@ -1167,7 +1171,7 @@ static void parse_media(pj_scanner *scanner, pjmedia_sdp_media *med,
 279
 280      /* format list */
 281      med->desc.fmt_count = 0;
 282 -    while (*scanner->curptr == ' ') {
 283 +    while (scanner->curptr < scanner->end && *scanner->curptr == ' ') {
 284         pj_str_t fmt;
 285
 286         pj_scan_get_char(scanner);
 287 @@ -1207,7 +1211,7 @@ static pjmedia_sdp_attr *parse_attr( pj_pool_t *pool, pj_scanner *scanner,
 288      attr = PJ_POOL_ALLOC_T(pool, pjmedia_sdp_attr);
 289
 290      /* check equal sign */
 291 -    if (*(scanner->curptr+1) != '=') {
 292 +    if (scanner->curptr+1 >= scanner->end || *(scanner->curptr+1) != '=') {
 293         on_scanner_error(scanner);
 294         return NULL;
 295      }
 296 @@ -1226,7 +1230,7 @@ static pjmedia_sdp_attr *parse_attr( pj_pool_t *pool, pj_scanner *scanner,
 297             pj_scan_get_char(scanner);
 298
 299         /* get value */
 300 -       if (*scanner->curptr != '\r' && *scanner->curptr != '\n') {
 301 +       if (!pj_scan_is_eof(scanner) && *scanner->curptr != '\r' && *scanner->curptr != '\n') {
 302             pj_scan_get_until_chr(scanner, "\r\n", &attr->value);
 303         } else {
 304             attr->value.ptr = NULL;
 305 --
 306 2.25.1
 307