CVE-2022-47517 (published 2022-12-18T05:15Z)

An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that causes a url_canonize2 heap-based buffer over-read because of an off-by-one error.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-193
cwe_name: Off-by-one Error
description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/davehorton/sofia-sip
commit_details: repo_url: https://github.com/davehorton/sofia-sip
author: Dave Horton
author_date: 2022-11-27 19:47:24-05:00
msg: fix off-by-one access triggered eg by Contact: %
repository: repo_url: https://github.com/davehorton/sofia-sip
repo_name: davehorton/sofia-sip
description: Sofia sip stack (forked from gitorious 1/1/2014)
repo_language: C
owner: davehorton
file_changes: filename: url.c
change_type: ModificationType.MODIFY
diff: @@ -185,7 +185,7 @@ int url_reserved_p(char const *s)
  * The number of characters in corresponding but escaped string.
  *
  * You can handle a part of URL with reserved characters like this:
- *@code
+ *�@code
  * if (url_reserved_p(s))  {
  *   n = malloc(url_esclen(s, NULL) + 1);
  *   if (n) url_escape(n, s);
@@ -364,6 +364,7 @@ char *url_canonize2(char *d, char const * const s, size_t n,
       continue;
     }
 
+    if (i >= strlen(s) - 1) return NULL;
     h1 = s[i + 1], h2 = s[i + 2];
 
     if (!IS_HEX(h1) || !IS_HEX(h2)) {
@@ -1088,7 +1089,7 @@ char *copy(char *buf, char *end, char const *src)
  * @param buf     Buffer for non-constant strings copied from @a src.
  * @param bufsize Size of @a buf.
  * @param dst     Destination URL structure.
- *@param src     Source URL structure.
+ *�@param src     Source URL structure.
  *
  * @return Number of characters required for
  * duplicating the strings in @a str, or -1 if an error
@@ -1172,7 +1173,7 @@ issize_t url_dup(char *buf, isize_t bufsize, url_t *dst, url_t const *src)
  * @param buf     Buffer for non-constant strings copied from @a src.
  * @param end     End of @a buf.
  * @param dst     Destination URL structure.
- *@param src     Source URL structure.
+ *�@param src     Source URL structure.
  *
  * @return
  * The macro URL_DUP() returns pointer to first unused byte in the

programming_language: C
repo_url: https://github.com/davehorton/sofia-sip
commit_details: repo_url: https://github.com/davehorton/sofia-sip
author: Dave Horton
author_date: 2022-11-27 20:06:46-05:00
msg: better fix for prev commit
repository: repo_url: https://github.com/davehorton/sofia-sip
repo_name: davehorton/sofia-sip
description: Sofia sip stack (forked from gitorious 1/1/2014)
repo_language: C
owner: davehorton
file_changes: filename: url.c
change_type: ModificationType.MODIFY
diff: @@ -364,8 +364,12 @@ char *url_canonize2(char *d, char const * const s, size_t n,
       continue;
     }
 
-    if (i >= strlen(s) - 1) return NULL;
-    h1 = s[i + 1], h2 = s[i + 2];
+    h1 = s[i + 1];
+    if (!h1) {
+        *d = '\0';
+        return NULL;
+    }
+    h2 = s[i + 2];
 
     if (!IS_HEX(h1) || !IS_HEX(h2)) {
       *d = '\0';
@@ -398,7 +402,6 @@ char *url_canonize2(char *d, char const * const s, size_t n,
   return d;
 }
 
-
 /** Canonize a URL component (with precomputed mask).
  *
  * This version does not flag error if *s contains character that should

programming_language: C