]> git.ipfire.org Git - thirdparty/asterisk.git/commit
chan_websocket: Fix buffer overrun when processing TEXT websocket frames.
authorGeorge Joseph <gjoseph@sangoma.com>
Tue, 19 Aug 2025 15:46:39 +0000 (09:46 -0600)
committerAsterisk Development Team <asteriskteam@digium.com>
Wed, 10 Sep 2025 19:53:00 +0000 (19:53 +0000)
commit959f69be52c0bdc6c8305c1edba80b8fb8fc2b72
treecfe15ddd34e744b23593bfdb55f9ad5e2a4cdfb4
parent6f79bdb8af00ef6ae1424e7deb4b5dc8ea209c8c
chan_websocket: Fix buffer overrun when processing TEXT websocket frames.

ast_websocket_read() receives data into a fixed 64K buffer then continually
reallocates a final buffer that, after all continuation frames have been
received, is the exact length of the data received and returns that to the
caller.  process_text_message() in chan_websocket was attempting to set a
NULL terminator on the received payload assuming the payload buffer it
received was the large 64K buffer.  The assumption was incorrect so when it
tried to set a NULL terminator on the payload, it could, depending on the
state of the heap at the time, cause heap corruption.

process_text_message() now allocates its own payload_len + 1 sized buffer,
copies the payload received from ast_websocket_read() into it then NULL
terminates it prevent the possibility of the overrun and corruption.

Resolves: #1384
(cherry picked from commit 076423aa18808e2a4fff1259cd927b1f562081c0)
channels/chan_websocket.c