sr-dev July 2024

sr-dev@lists.kamailio.org

16 participants
211 discussions

[kamailio/kamailio] cdp: fix use after free in transaction call backs (PR #3931)
by Rick Barenthin 25 Jul '24

25 Jul '24

If the traction is set to auto drop, the memory will be freed and with it the next pointer.   #### Pre-Submission Checklist    - [x] Commit message has the format required by CONTRIBUTING guide - [x] Commits are split per component (core, individual modules, libs, utils, ...) - [x] Each component has a single commit (if not, squash them into one commit) - [x] No commits to README files for modules (changes must be done to docbook files in `doc/` subfolder, the README file is autogenerated) #### Type Of Change - [x] Small bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds new functionality) - [ ] Breaking change (fix or feature that would change existing functionality) #### Checklist:  - [ ] PR should be backported to stable branches - [x] Tested changes locally - [ ] Related to issue #XXXX (replace XXXX with an open issue number) #### Description  The use after free caused on a Load tested system crashes. Now the next pointer is saved before executing the callback and handle the auto drop. Then the stored next pointer is used to continue the iteration over the callbacks. You can view, comment on, or merge this pull request online at: https://github.com/kamailio/kamailio/pull/3931 -- Commit Summary -- * cdp: fix use after free in transaction call backs -- File Changes -- M src/modules/cdp/transaction.c (3) -- Patch Links -- https://github.com/kamailio/kamailio/pull/3931.patch https://github.com/kamailio/kamailio/pull/3931.diff -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/pull/3931 You are receiving this because you are subscribed to this thread. Message ID: <kamailio/kamailio/pull/3931(a)github.com>

3 2

git:master:a71bd9d9: cdp: fix use after free in transaction call backs
by Daniel-Constantin Mierla 25 Jul '24

25 Jul '24

Module: kamailio Branch: master Commit: a71bd9d9424456ef1167468c5bbbfd38b1099e89 URL: https://github.com/kamailio/kamailio/commit/a71bd9d9424456ef1167468c5bbbfd3… Author: Rick Barenthin <rick(a)ng-voice.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2024-07-25T12:20:59+02:00 cdp: fix use after free in transaction call backs If the traction is set to auto drop, the memory will be freed and with it the next pointer. --- Modified: src/modules/cdp/transaction.c --- Diff: https://github.com/kamailio/kamailio/commit/a71bd9d9424456ef1167468c5bbbfd3… Patch: https://github.com/kamailio/kamailio/commit/a71bd9d9424456ef1167468c5bbbfd3… --- diff --git a/src/modules/cdp/transaction.c b/src/modules/cdp/transaction.c index f1445ff15be..a2b97654dd0 100644 --- a/src/modules/cdp/transaction.c +++ b/src/modules/cdp/transaction.c @@ -256,10 +256,11 @@ int cdp_trans_timer(time_t now, void *ptr) /* do all queued callbacks */ x = cb_queue->head; while(x) { + n = x->next; (x->cb)(1, *(x->ptr), 0, (now - x->expires)); if(x->auto_drop) cdp_free_trans(x); - x = x->next; + x = n; } pkg_free(cb_queue);

1 0

[kamailio/kamailio] ims_qos_npn: fixed issues discovered by coverity (PR #3926)
by Dragos Vingarzan 25 Jul '24

25 Jul '24

#### Pre-Submission Checklist    - [x] Commit message has the format required by CONTRIBUTING guide - [x] Commits are split per component (core, individual modules, libs, utils, ...) - [x] Each component has a single commit (if not, squash them into one commit) - [x] No commits to README files for modules (changes must be done to docbook files in `doc/` subfolder, the README file is autogenerated) #### Type Of Change - [x] Small bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds new functionality) - [ ] Breaking change (fix or feature that would change existing functionality) #### Checklist:  - [ ] PR should be backported to stable branches - [ ] Tested changes locally - [ ] Related to issue #XXXX (replace XXXX with an open issue number) #### Description  Fixing issues discovered by Coverity You can view, comment on, or merge this pull request online at: https://github.com/kamailio/kamailio/pull/3926 -- Commit Summary -- * ims_qos_npn: fixed issues discovered by coverity -- File Changes -- M src/modules/ims_qos_npn/rx_aar.c (12) M src/modules/ims_qos_npn/rx_avp.c (5) -- Patch Links -- https://github.com/kamailio/kamailio/pull/3926.patch https://github.com/kamailio/kamailio/pull/3926.diff -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/pull/3926 You are receiving this because you are subscribed to this thread. Message ID: <kamailio/kamailio/pull/3926(a)github.com>

2 2

git:master:79433959: ims_qos_npn: fixed missing breaks in switch and checks for null pointers
by Dragos Vingarzan 25 Jul '24

25 Jul '24

Module: kamailio Branch: master Commit: 7943395957c070a16553b16536e5be59b4719d9b URL: https://github.com/kamailio/kamailio/commit/7943395957c070a16553b16536e5be5… Author: Dragos Vingarzan <vingarzan(a)gmail.com> Committer: Dragos Vingarzan <vingarzan(a)gmail.com> Date: 2024-07-25T11:47:24+02:00 ims_qos_npn: fixed missing breaks in switch and checks for null pointers --- Modified: src/modules/ims_qos_npn/rx_aar.c Modified: src/modules/ims_qos_npn/rx_avp.c --- Diff: https://github.com/kamailio/kamailio/commit/7943395957c070a16553b16536e5be5… Patch: https://github.com/kamailio/kamailio/commit/7943395957c070a16553b16536e5be5… --- diff --git a/src/modules/ims_qos_npn/rx_aar.c b/src/modules/ims_qos_npn/rx_aar.c index fc99344c2c6..4423a0561b2 100644 --- a/src/modules/ims_qos_npn/rx_aar.c +++ b/src/modules/ims_qos_npn/rx_aar.c @@ -615,7 +615,7 @@ int add_media_components(AAAMessage *aar, struct sip_msg *req, //check if the src or dst port is 0 and if so then don't add to rx intportA = atoi(req_sdp_stream->port.s); - if(rpl) { + if(rpl_sdp_stream) { intportB = atoi(rpl_sdp_stream->port.s); } if(intportA != 0 && (rpl && intportB != 0)) { @@ -719,18 +719,20 @@ int add_media_components(AAAMessage *aar, struct sip_msg *req, auth->u.auth.generic_data, sdp_stream_num + 1, &req_sdp_stream->media, &ipA, &portA, &ipB, &portB, - rpl ? &rpl_sdp_stream->transport : 0, + rpl_sdp_stream ? &rpl_sdp_stream->transport : 0, &req_sdp_stream->raw_stream, - rpl ? &rpl_sdp_stream->raw_stream : 0, + rpl_sdp_stream ? &rpl_sdp_stream->raw_stream + : 0, direction, 0 /*This is a new mcd, we are not setting it as active*/); rx_add_media_component_description_avp(aar, sdp_stream_num + 1, &req_sdp_stream->media, &ipA, &portA, &ipB, &portB, - rpl ? &rpl_sdp_stream->transport : 0, + rpl_sdp_stream ? &rpl_sdp_stream->transport : 0, &req_sdp_stream->raw_stream, - rpl ? &rpl_sdp_stream->raw_stream : 0, + rpl_sdp_stream ? &rpl_sdp_stream->raw_stream + : 0, direction, AVP_EPC_Flow_Usage_No_Information); } add_flow = 1; diff --git a/src/modules/ims_qos_npn/rx_avp.c b/src/modules/ims_qos_npn/rx_avp.c index a0053138b4f..a2fd3188efe 100644 --- a/src/modules/ims_qos_npn/rx_avp.c +++ b/src/modules/ims_qos_npn/rx_avp.c @@ -1402,7 +1402,7 @@ int rx_mcc_mnc_to_sip_visited(str *dst, str src) } mcc = (100 * (src.s[0] - '0') + (10 * (src.s[1] - '0')) + ((src.s[2] - '0'))); - if(mcc < 0 || mcc >= 999) { + if(mcc >= 999) { LOG(L_ERR, "Invalid MCC value\n"); return 0; } @@ -1699,6 +1699,7 @@ int rx_avp_process_3gpp_user_location_information(AAAMessage *rar, str *dst) p += 7; length -= 7; } + break; case 1: // SAI if(length >= 7) { @@ -1707,6 +1708,7 @@ int rx_avp_process_3gpp_user_location_information(AAAMessage *rar, str *dst) p += 7; length -= 7; } + break; case 2: // RAI if(length >= 7) { @@ -1715,6 +1717,7 @@ int rx_avp_process_3gpp_user_location_information(AAAMessage *rar, str *dst) p += 7; length -= 7; } + break; case 3 ... 127: // spare for future use break;

1 0

git:master:b4efe772: janssonrpcc: free new servers list on error
by Daniel-Constantin Mierla 25 Jul '24

25 Jul '24

Module: kamailio Branch: master Commit: b4efe7725728392d0c8921c006d6fbc6455e9b8f URL: https://github.com/kamailio/kamailio/commit/b4efe7725728392d0c8921c006d6fbc… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2024-07-25T10:59:15+02:00 janssonrpcc: free new servers list on error --- Modified: src/modules/janssonrpcc/janssonrpc_srv.c --- Diff: https://github.com/kamailio/kamailio/commit/b4efe7725728392d0c8921c006d6fbc… Patch: https://github.com/kamailio/kamailio/commit/b4efe7725728392d0c8921c006d6fbc… --- diff --git a/src/modules/janssonrpcc/janssonrpc_srv.c b/src/modules/janssonrpcc/janssonrpc_srv.c index 73eb25ce62d..9b7ac31c084 100644 --- a/src/modules/janssonrpcc/janssonrpc_srv.c +++ b/src/modules/janssonrpcc/janssonrpc_srv.c @@ -90,6 +90,7 @@ int refresh_srv(jsonrpc_srv_t *srv_obj) srv_record = (struct srv_rdata *)l->rdata; if(srv_record == NULL) { free_rdata_list(head); + free_server_list(new_servers); ERR("BUG: null rdata\n"); return -1; }

1 0

git:master:a8cb2390: pkg: Add systemd template for starting multiple kamailio services
by Xenofon Karamanos 25 Jul '24

25 Jul '24

Module: kamailio Branch: master Commit: a8cb23903b271a1b78456fed5da8e10474aee405 URL: https://github.com/kamailio/kamailio/commit/a8cb23903b271a1b78456fed5da8e10… Author: Xenofon Karamanos <22965395+xkaraman(a)users.noreply.github.com> Committer: Xenofon Karamanos <22965395+xkaraman(a)users.noreply.github.com> Date: 2024-07-25T11:11:36+03:00 pkg: Add systemd template for starting multiple kamailio services --- Added: pkg/kamailio/deb/debian/kamailio@.service --- Diff: https://github.com/kamailio/kamailio/commit/a8cb23903b271a1b78456fed5da8e10… Patch: https://github.com/kamailio/kamailio/commit/a8cb23903b271a1b78456fed5da8e10… --- diff --git a/pkg/kamailio/deb/debian/kamailio@.service b/pkg/kamailio/deb/debian/kamailio@.service new file mode 100644 index 00000000000..81c06394d17 --- /dev/null +++ b/pkg/kamailio/deb/debian/kamailio@.service @@ -0,0 +1,26 @@ +[Unit] +Description=Kamailio - the Open Source SIP Server (instance %i) +Documentation=man:kamailio(8) +Wants=network-online.target +After=network-online.target + +[Service] +Type=forking +User=kamailio +Group=kamailio +Environment='CFGFILE=/etc/kamailio/kamailio-%i.cfg' +Environment='SHM_MEMORY=64' +Environment='PKG_MEMORY=8' +EnvironmentFile=-/etc/default/kamailio-%i +EnvironmentFile=-/etc/default/kamailio-%i.d/* +# PIDFile requires a full absolute path +PIDFile=/run/kamailio-%i/kamailio.pid +# ExecStart requires a full absolute path +ExecStart=/usr/sbin/kamailio -P /run/kamailio-%i/kamailio.pid -Y /run/kamailio-%i -f $CFGFILE -m $SHM_MEMORY -M $PKG_MEMORY +Restart=on-failure +# /run/kamailio in tmpfs +RuntimeDirectory=kamailio-%i +RuntimeDirectoryMode=0770 + +[Install] +WantedBy=multi-user.target

1 0

git:master:a6c41571: core: cfg select - check res before initializing
by Daniel-Constantin Mierla 25 Jul '24

25 Jul '24

Module: kamailio Branch: master Commit: a6c415713bb209b03ff110d4ae891173d04ac471 URL: https://github.com/kamailio/kamailio/commit/a6c415713bb209b03ff110d4ae89117… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2024-07-25T08:44:15+02:00 core: cfg select - check res before initializing --- Modified: src/core/cfg/cfg_select.c --- Diff: https://github.com/kamailio/kamailio/commit/a6c415713bb209b03ff110d4ae89117… Patch: https://github.com/kamailio/kamailio/commit/a6c415713bb209b03ff110d4ae89117… --- diff --git a/src/core/cfg/cfg_select.c b/src/core/cfg/cfg_select.c index f3b2d681d3e..e6c599a204e 100644 --- a/src/core/cfg/cfg_select.c +++ b/src/core/cfg/cfg_select.c @@ -147,8 +147,10 @@ int select_cfg_var(str *res, select_t *s, struct sip_msg *msg) int i; static char buf[INT2STR_MAX_LEN]; - res->s = 0; - res->len = 0; + if(res != NULL) { + res->s = 0; + res->len = 0; + } if(msg == NULL) { /* fixup call */

1 0

[kamailio/kamailio] t_uac_send parser does not like exclamation or other non alphabetic characters in Contact header (Issue #3682)
by xaled1 24 Jul '24

24 Jul '24

Hi there is an issue with the SIP parser for the t_uac_send function https://www.kamailio.org/docs/modules/devel/modules/tm.html#tm.f.t_uac_send If I call this function for example: t_uac_send("INVITE", "sip:test@123.123.123.123:5060", "", "" ,"Content-Type: text/plain\r\nContact: <sip:85951b3d-096c-95d6-5f05-4f38095aca9f@172.17.64.120:5060;transport=tcp>;+u.sip!devicename.ccm.cisco.com=\"SEP5486BC7F2BBC\"", "Testbody") Then the resulting request is broken - it's probably due to a character (exclamation mark?) in the Contact header.... I tested it with a call from kemi, but it probably also occurs when you run it with a normal kamailio -script tests -- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/3682 You are receiving this because you are subscribed to this thread. Message ID: <kamailio/kamailio/issues/3682(a)github.com>

3 4

git:master:7ba313f6: jsonrpcc: declare variables are the beginning of function
by Daniel-Constantin Mierla 24 Jul '24

24 Jul '24

Module: kamailio Branch: master Commit: 7ba313f6f96ffa6042c163027c0c7bb65106fef7 URL: https://github.com/kamailio/kamailio/commit/7ba313f6f96ffa6042c163027c0c7bb… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2024-07-24T10:43:18+02:00 jsonrpcc: declare variables are the beginning of function --- Modified: src/modules/jsonrpcc/netstring.c --- Diff: https://github.com/kamailio/kamailio/commit/7ba313f6f96ffa6042c163027c0c7bb… Patch: https://github.com/kamailio/kamailio/commit/7ba313f6f96ffa6042c163027c0c7bb… --- diff --git a/src/modules/jsonrpcc/netstring.c b/src/modules/jsonrpcc/netstring.c index be7a5de8108..9328a46215e 100644 --- a/src/modules/jsonrpcc/netstring.c +++ b/src/modules/jsonrpcc/netstring.c @@ -35,11 +35,13 @@ int netstring_read_fd(int fd, char **netstring) { int i, bytes; size_t len = 0; + size_t read_len = 0; + char buffer[10] = {0}; + char *buffer2 = NULL; + int x; *netstring = NULL; - char buffer[10] = {0}; - /* Peek at first 10 bytes, to get length and colon */ bytes = recv(fd, buffer, 10, MSG_PEEK); @@ -68,8 +70,8 @@ int netstring_read_fd(int fd, char **netstring) return NETSTRING_ERROR_NO_COLON; /* Read the whole string from the buffer */ - size_t read_len = i + len + 1; - char *buffer2 = pkg_malloc(read_len); + read_len = i + len + 1; + buffer2 = pkg_malloc(read_len); if(!buffer2) { LM_ERR("Out of memory!"); return -1; @@ -90,8 +92,6 @@ int netstring_read_fd(int fd, char **netstring) buffer2[read_len - 1] = '\0'; - int x; - for(x = 0; x <= read_len - i - 1; x++) { buffer2[x] = buffer2[x + i]; }

1 0

git:master:796bcc03: jsonrpcc: free allocated pkg buffer on error
by Daniel-Constantin Mierla 24 Jul '24

24 Jul '24

Module: kamailio Branch: master Commit: 796bcc038d7885e01dbad34abc68bf612062c533 URL: https://github.com/kamailio/kamailio/commit/796bcc038d7885e01dbad34abc68bf6… Author: Daniel-Constantin Mierla <miconda(a)gmail.com> Committer: Daniel-Constantin Mierla <miconda(a)gmail.com> Date: 2024-07-24T10:37:21+02:00 jsonrpcc: free allocated pkg buffer on error --- Modified: src/modules/jsonrpcc/netstring.c --- Diff: https://github.com/kamailio/kamailio/commit/796bcc038d7885e01dbad34abc68bf6… Patch: https://github.com/kamailio/kamailio/commit/796bcc038d7885e01dbad34abc68bf6… --- diff --git a/src/modules/jsonrpcc/netstring.c b/src/modules/jsonrpcc/netstring.c index bf7294ceb41..be7a5de8108 100644 --- a/src/modules/jsonrpcc/netstring.c +++ b/src/modules/jsonrpcc/netstring.c @@ -77,12 +77,16 @@ int netstring_read_fd(int fd, char **netstring) bytes = recv(fd, buffer2, read_len, 0); /* Make sure we got the whole netstring */ - if(read_len > bytes) + if(read_len > bytes) { + pkg_free(buffer2); return NETSTRING_ERROR_TOO_SHORT; + } /* Test for the trailing comma */ - if(buffer2[read_len - 1] != ',') + if(buffer2[read_len - 1] != ',') { + pkg_free(buffer2); return NETSTRING_ERROR_NO_COMMA; + } buffer2[read_len - 1] = '\0';

1 0

← Newer
1
...
4
5
6
7
8
9
10
...
22
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev July 2024