From: Matthew Jordan Date: Thu, 15 Mar 2012 18:50:17 +0000 (+0000) Subject: Fix remotely exploitable stack overrun in Milliwatt X-Git-Tag: 10.3.0~29 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e10005d38facfb62260d6e274037d84eda58414b;p=thirdparty%2Fasterisk.git Fix remotely exploitable stack overrun in Milliwatt Milliwatt is vulnerable to a remotely exploitable stack overrun when using the 'o' option. This occurs due to the milliwatt_generate function not accounting for AST_FRIENDLY_OFFSET when calculating the maximum number of samples it can put in the output buffer. This patch resolves this issue by taking into account AST_FRIENDLY_OFFSET when determining the maximum number of samples allowed. Note that at no point is remote code execution possible. The data that is written into the buffer is the pre-defined Milliwatt data, and not custom data. (closes issue ASTERISK-19541) Reported by: Russell Bryant Tested by: Matt Jordan Patches: milliwatt_stack_overrun.rev1.txt by Russell Bryant (license 6283) Note that this patch was written by Russell, even though Matt uploaded it ........ Merged revisions 359645 from http://svn.asterisk.org/svn/asterisk/branches/1.6.2 ........ Merged revisions 359656 from http://svn.asterisk.org/svn/asterisk/branches/1.8 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/10@359694 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- diff --git a/apps/app_milliwatt.c b/apps/app_milliwatt.c index dc37e7e896..72a800933d 100644 --- a/apps/app_milliwatt.c +++ b/apps/app_milliwatt.c @@ -78,7 +78,7 @@ static void milliwatt_release(struct ast_channel *chan, void *data) static int milliwatt_generate(struct ast_channel *chan, void *data, int len, int samples) { unsigned char buf[AST_FRIENDLY_OFFSET + 640]; - const int maxsamples = ARRAY_LEN(buf); + const int maxsamples = ARRAY_LEN(buf) - (AST_FRIENDLY_OFFSET / sizeof(buf[0])); int i, *indexp = (int *) data; struct ast_frame wf = { .frametype = AST_FRAME_VOICE,