Changeset 5693

Timestamp:

Nov 14, 2017 8:20:15 AM (7 years ago)

Author:

ming

Message:

Fixed #2063: Add more documentation in PJSIP's parser to prevent stack buffer overflow

Location:

pjproject/trunk

Files:

• pjlib-util/include/pjlib-util/scanner.h (modified) (1 diff)
• pjlib-util/src/pjlib-util/scanner.c (modified) (2 diffs)
• pjsip/include/pjsip/sip_parser.h (modified) (7 diffs)
• pjsip/src/pjsip/sip_multipart.c (modified) (1 diff)

pjproject/trunk/pjlib-util/include/pjlib-util/scanner.h

@@ -217 +217 @@
 
 /**
- * Initialize the scanner. Note that the input string buffer must have
- * length at least buflen+1 because the scanner will NULL terminate the
- * string during initialization.
+ * Initialize the scanner.
+ * Note that the input string buffer MUST be NULL terminated and have
+ * length at least buflen+1 (buflen MUST NOT include the NULL terminator).
  *
  * @param scanner   The scanner to be initialized.
- * @param bufstart  The input buffer to scan. Note that buffer[buflen] will be 
- *                  filled with NULL char until scanner is destroyed, so
- *                  the actual buffer length must be at least buflen+1.
+ * @param bufstart  The input buffer to scan, which must be NULL terminated.
  * @param buflen    The length of the input buffer, which normally is
- *                  strlen(bufstart).
+ *                  strlen(bufstart), hence not counting the NULL terminator.
  * @param options   Zero, or combination of PJ_SCAN_AUTOSKIP_WS or
  *                  PJ_SCAN_AUTOSKIP_WS_HEADER

pjproject/trunk/pjlib-util/src/pjlib-util/scanner.c

@@ -23 +23 @@
 #include <pj/except.h>
 #include <pj/os.h>
+#include <pj/log.h>
 #include <pj/errno.h>
 #include <pj/assert.h>
+
+#define THIS_FILE   "scanner.c"
 
 #define PJ_SCAN_IS_SPACE(c)             ((c)==' ' || (c)=='\t')
@@ -117 +120 @@
 {
     PJ_CHECK_STACK();
+
+    /* Buffer validation. Must be NULL terminated.
+     * See ticket #2063.
+     */
+    pj_assert(*scanner->end == 0);
 
     scanner->begin = scanner->curptr = bufstart;

pjproject/trunk/pjsip/include/pjsip/sip_parser.h

@@ -197 +197 @@
 /**
  * Parse an URI in the input and return the correct instance of URI.
+ * Note that the input string buffer MUST be NULL terminated and have
+ * length at least size+1 (size MUST NOT include the NULL terminator).
  *
  * @param pool          The pool to get memory allocations.
@@ -217 +219 @@
 /**
  * Parse SIP status line.
+ * Note that the input string buffer MUST be NULL terminated and have
+ * length at least size+1 (size MUST NOT include the NULL terminator).
  *
  * @param buf           Text buffer to parse, which MUST be NULL terminated.
@@ -235 +239 @@
  * of the body.
  *
+ * Note that the input string buffer MUST be NULL terminated and have
+ * length at least size+1 (size MUST NOT include the NULL terminator).
+ *
  * @param pool          The pool to allocate memory.
  * @param buf           The input buffer, which MUST be NULL terminated.
@@ -257 +264 @@
  * This function is normally called by the transport layer.
  *
+ * Note that the input string buffer MUST be NULL terminated and have
+ * length at least size+1 (size MUST NOT include the NULL terminator).
+ *
  * @param buf           The input buffer, which MUST be NULL terminated.
  * @param size          The length of the string (not counting NULL terminator).
@@ -270 +280 @@
  * Check incoming packet to see if a (probably) valid SIP message has been 
  * received.
+ * Note that the input string buffer MUST be NULL terminated.
  *
  * @param buf           The input buffer, which must be NULL terminated.
@@ -288 +299 @@
  * This function parses the content of a header (ie. part after colon) according
  * to the expected name, and will return the correct instance of header.
+ *
+ * Note that the input string buffer MUST be NULL terminated and have
+ * length at least size+1 (size MUST NOT include the NULL terminator). 
  *
  * @param pool          Pool to allocate memory for the header.
@@ -315 +329 @@
  * is optional for the last header.
  *
+ * Note that the input string buffer MUST be NULL terminated and have
+ * length at least size+1 (size MUST NOT include the NULL terminator).
+ *
  * @param pool          The pool.
  * @param input         The input text to parse, which must be NULL terminated.
- * @param size          The text length.
+ * @param size          The text length (not counting NULL terminator).
  * @param hlist         The header list to store the parsed headers.
  *                      This list must have been initialized before calling 

pjproject/trunk/pjsip/src/pjsip/sip_multipart.c

@@ -663 +663 @@
             if (*(end_body-1) == '\n')
                 --end_body;
-            if (*(end_body-1) == '\r')
+            if (end_body > start_body && *(end_body-1) == '\r')
                 --end_body;
         }