Sean Bright [Mon, 5 Feb 2018 22:46:26 +0000 (17:46 -0500)]
AST-2018-006: Properly handle WebSocket frames with 0 length payload.
In ast_websocket_read() we were not adequately checking that the
payload_len was non-zero before passing it to ws_safe_read(). Calling
ws_safe_read with a len argument of 0 will result in a busy loop until
the underlying socket is closed.
Kevin Harwell [Wed, 31 Jan 2018 19:37:54 +0000 (13:37 -0600)]
AST-2018-003: Crash with an invalid SDP fmtp attribute
pjproject's fmtp retrieval function failed to catch invalid fmtp attributes.
Because of this Asterisk would crash if given an SDP with an invalid fmtp
attribute.
When retrieving the format this patch now makes sure the fmtp attribute is
available. If not available it now returns an error status.
Kevin Harwell [Wed, 31 Jan 2018 19:33:16 +0000 (13:33 -0600)]
AST-2018-002: Crash with an invalid SDP media format description
pjproject's media format parsing algorithm failed to catch invalid values.
Because of this Asterisk would crash if given an SDP with a invalid media
format description.
When parsing the media format description this patch now properly parses the
value and returns an error status if it can't successfully parse/convert the
value.
George Joseph [Tue, 6 Feb 2018 18:07:18 +0000 (11:07 -0700)]
AST-2018-005: res_pjsip_transport_management: Move to core
Since res_pjsip_transport_management provides several attack
mitigation features, its functionality moved to res_pjsip and
this module has been removed. This way the features will always
be available if res_pjsip is loaded.
George Joseph [Tue, 6 Feb 2018 17:28:49 +0000 (10:28 -0700)]
AST-2018-005: Fix tdata leaks when calling pjsip_endpt_send_response(2)
pjsip_distributor:
authenticate() creates a tdata and uses it to send a challenge or
failure response. When pjsip_endpt_send_response2() succeeds, it
automatically decrements the tdata ref count but when it fails, it
doesn't. Since we weren't checking for a return status, we weren't
decrementing the count ourselves on error and were therefore leaking
tdatas.
res_pjsip_session:
session_reinvite_on_rx_request wasn't decrementing the ref count
if an error happened while sending a 491 response.
pre_session_setup wasn't decrementing the ref count if
while sending an error after a pjsip_inv_verify_request failure.
res_pjsip:
ast_sip_send_response wasn't decrementing the ref count on error.
George Joseph [Tue, 6 Feb 2018 17:21:32 +0000 (10:21 -0700)]
AST-2018-005: Add a check for NULL tdata in ast_sip_failover_request
It was discovered that there are some corner cases where a pjsip tsx
might have no last_tx so calling ast_sip_failover_request with
a NULL last_tx as its tdata would cause a crash.
Joshua Colp [Wed, 7 Feb 2018 14:09:14 +0000 (14:09 +0000)]
AST-2018-004: Restrict the number of Accept headers in a SUBSCRIBE.
When receiving a SUBSCRIBE request the Accept headers from it are
stored locally. This operation has a fixed limit of 32 Accept headers
but this limit was not enforced. As a result it was possible for
memory outside of the allocated space to get written to resulting
in a crash.
This change enforces the limit so only 32 Accept headers are
processed.
Joshua Colp [Sat, 13 Jan 2018 14:04:33 +0000 (14:04 +0000)]
AST-2018-001: rtp / channel: Don't allow an unnegotiated format to be passed up.
When an RTP packet is received by an RTP engine it has to map the
payload into the Asterisk format. The code was incorrectly checking
our own static list for ALL payloads if it couldn't find a negotiated one.
This included dynamic payloads. If the payload mapped to a format
of a different type (for example receiving a video packet on an audio
RTP instance) then the core stream code could cause a crash if a legacy
channel driver was in use as no stream would be present.
To provide further protection the core stream code will no longer assume
that a video or audio frame will always have a stream for legacy channel
drivers. If no stream is present the frame is dropped.
Corey Farrell [Mon, 19 Feb 2018 09:57:45 +0000 (04:57 -0500)]
core: Rename sounds_index.c to sounds.c.
This will make the source filename match the 'module reload sounds'
command. This will allow conversion to a built-in module in Asterisk 16
without needing to redefine AST_MODULE.
Corey Farrell [Fri, 16 Feb 2018 23:58:35 +0000 (18:58 -0500)]
BuildSystem: Use single bootstrap.sh for Asterisk and menuselect.
This causes the root bootstrap.sh script to generate configure scripts
for both Asterisk and menuselect. This ensures that both configure
scripts are generated with the same version of autotools and avoids
situations where shared autoconf macros get modified without
regenerating the menuselect script.
Corey Farrell [Wed, 31 Jan 2018 02:31:51 +0000 (21:31 -0500)]
json: Add conditionals to avoid locking if Jansson is thread safe.
Jansson is thread safe for all read-only functions and reference
counting starting v2.11. This allows simplification of our code and
removal of locking around reference counting and dumping.
Alexander Traud [Mon, 12 Feb 2018 12:16:00 +0000 (13:16 +0100)]
pjproject_bundled: Disable G.729 from Belledonne Communications.
When <http://github.com/BelledonneCommunications/bcg729> is installed, PJProject
tries to link that. Support for this bcg729 was added with PJProject 2.7. The
issue happens, because Teluu enabled that new feature on default.
Oron Peled [Tue, 19 Dec 2017 08:52:54 +0000 (10:52 +0200)]
chan_console: don't read and write at the same time
It seems that the ALSA backend of PortAudio doesn't know how to both
read and write at the same time by adding a per-device mutex.
FIXME: currently only a draft version. Need to either auto-detect
we work with the ALSA backend or add an extra configuration option
to use this mutex.
Richard Mudgett [Wed, 31 Jan 2018 23:48:46 +0000 (17:48 -0600)]
app_confbridge: ConfbridgeList event has standard channel shapshot headers.
* Made the AMI ConfbridgeList action's ConfbridgeList events output all
the standard channel snapshot headers instead of a few hand-coded channel
snapshot headers. The benefit is that the CallerIDName gets disruptive
characters like CR, LF, Tab, and a few others escaped. However, an empty
CallerIDName is now output as "<unknown>" instead of "<no name>".
Richard Mudgett [Fri, 2 Feb 2018 23:35:20 +0000 (17:35 -0600)]
endpoint identifiers: Some code cleanup.
res_pjsip_endpoint_identifier_user.c:
* Fix copy/paste error in find_endpoint(). We were using a constant
"anonymous" string instead of the passed in endpoint_name when checking
the transport domain for an endpoint match.
* Eliminate RAII_VAR in find_endpoint().
* Remove always true check in find_transport_state_in_use().
* Remove useless CMD_STOP in find_transport_state_in_use().
res_pjsip_endpoint_identifier_anonymous.c:
* Eliminate RAII_VAR in anonymous_identify().
* Remove always true check in find_transport_state_in_use().
* Remove useless CMD_STOP in find_transport_state_in_use().
projects / thirdparty / asterisk.git / log
