From 854ec3826c0a86ca1e295eebb4ac61c12902ada9 Mon Sep 17 00:00:00 2001 From: Matthew Jordan Date: Wed, 27 Mar 2013 14:36:22 +0000 Subject: [PATCH] AST-2013-002: Prevent denial of service in HTTP server AST-2012-014, fixed in January of this year, contained a fix for Asterisk's HTTP server for a remotely-triggered crash. While the fix put in place fixed the possibility for the crash to be triggered, a denial of service vector still exists with that solution if an attacker sends one or more HTTP POST requests with very large Content-Length values. This patch resolves this by capping the Content-Length at 1024 bytes. Any attempt to send an HTTP POST with Content-Length greater than this cap will not result in any memory allocation. The POST will be responded to with an HTTP 413 "Request Entity Too Large" response. This issue was reported by Christoph Hebeisen of TELUS Security Labs (closes issue ASTERISK-20967) Reported by: Christoph Hebeisen patches: AST-2013-002-1.8.diff uploaded by mmichelson (License 5049) AST-2013-002-10.diff uploaded by mmichelson (License 5049) AST-2013-002-11.diff uploaded by mmichelson (License 5049) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/10@383977 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- main/http.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/main/http.c b/main/http.c index 6f6bde80e4..b327425873 100644 --- a/main/http.c +++ b/main/http.c @@ -593,6 +593,8 @@ void ast_http_uri_unlink_all_with_key(const char *key) AST_RWLIST_UNLOCK(&uris); } +#define MAX_POST_CONTENT 1025 + /* * get post variables from client Request Entity-Body, if content type is * application/x-www-form-urlencoded @@ -625,6 +627,13 @@ struct ast_variable *ast_http_get_post_vars( return NULL; } + if (content_length > MAX_POST_CONTENT - 1) { + ast_log(LOG_WARNING, "Excessively long HTTP content. %d is greater than our max of %d\n", + content_length, MAX_POST_CONTENT); + ast_http_send(ser, AST_HTTP_POST, 413, "Request Entity Too Large", NULL, NULL, 0, 0); + return NULL; + } + buf = ast_malloc(content_length + 1); if (!buf) { return NULL; -- 2.47.2