CVE-2022-45909 (published 2022-11-26T03:15Z)

drachtio-server before 0.8.19 has a heap-based buffer over-read via a long Request-URI in an INVITE request.

CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/drachtio/drachtio-server
commit_details: repo_url: https://github.com/drachtio/drachtio-server
author: Dave Horton
author_date: 2022-11-06 11:27:55-05:00
msg: sending an invite with a request-uri longer than 255 characters can cause a crash (#238)
repository: repo_url: https://github.com/drachtio/drachtio-server
repo_name: drachtio/drachtio-server
description: A SIP call processing server that can be controlled via nodejs applications
repo_language: C++
owner: drachtio
file_changes: filename: drachtio.cpp
change_type: ModificationType.MODIFY
diff: @@ -54,6 +54,8 @@ THE SOFTWARE.
 
 #define MAX_LINELEN 2047
 
+#define MAX_SIP_URI_LEN (1024)
+
 #define BOOST_UUID (1)
 
 using namespace std ;
@@ -336,8 +338,8 @@ namespace drachtio {
     bool normalizeSipUri( std::string& uri, int brackets ) {
         su_home_t* home = theOneAndOnlyController->getHome() ;
         char *s ;
-        char buf[255];
-        char obuf[255] ;
+        char buf[MAX_SIP_URI_LEN];
+        char obuf[MAX_SIP_URI_LEN] ;
         char hp[64] ;
         char const *display = NULL;
         url_t url[1];
@@ -346,7 +348,7 @@ namespace drachtio {
         int rc ;
 
         // buf gets passed into sip_name_addr_d which puts NULs in various locations so the url_t members can point to their bits
-        s = strncpy( buf, uri.c_str(), 255 ) ;
+        s = strncpy( buf, uri.c_str(), MAX_SIP_URI_LEN ) ;
 
         // first we decode the string
         rc = sip_name_addr_d(home, &s, &display, url, &params, &comment) ;
@@ -374,14 +376,14 @@ namespace drachtio {
             return false ;
         }
         uri.assign( obuf ) ;
-        return true ;
+        return uri.length() < MAX_SIP_URI_LEN ;
     }
 
     bool replaceHostInUri( std::string& uri, const char* szHost, const char* szPort ) {
         su_home_t* home = theOneAndOnlyController->getHome() ;
         char *s ;
-        char buf[255];
-        char obuf[255] ;
+        char buf[MAX_SIP_URI_LEN];
+        char obuf[MAX_SIP_URI_LEN] ;
         char hp[64] ;
         char const *display = NULL;
         url_t url[1];
@@ -404,7 +406,7 @@ namespace drachtio {
         url->url_port = szPort ;
 
         // now we re-encode it
-        int nChars = sip_name_addr_e(obuf, 255, 0, display, 1, url, params, comment) ;
+        int nChars = sip_name_addr_e(obuf, MAX_SIP_URI_LEN, 0, display, 1, url, params, comment) ;
 
         // cleanup: free the msg_params if any were allocated        
         if( params ) {

programming_language: C++
filename: sip-dialog-controller.cpp
change_type: ModificationType.MODIFY
diff: @@ -529,7 +529,9 @@ namespace drachtio {
              }
 
             //prevent looping messages
-            normalizeSipUri( requestUri, 0 ) ;
+            if (!normalizeSipUri( requestUri, 0 )) {
+                throw std::runtime_error(string("invalid request-uri: ") + requestUri ) ;
+            }
             if( isLocalSipUri( requestUri ) ) {
                 throw std::runtime_error("can not send request to myself") ;
             }

programming_language: C++