Skip to content

Commit

Permalink
Merge pull request from GHSA-7fw8-54cv-r7pm
Browse files Browse the repository at this point in the history
  • Loading branch information
@sauwming
sauwming committed Jan 26, 2022
1 parent 22af44e commit 077b465
Showing 1 changed file with 9 additions and 4 deletions.
13 changes: 9 additions & 4 deletions pjlib-util/src/pjlib-util/scanner.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -444,16 +444,21 @@ PJ_DEF(void) pj_scan_get_n( pj_scanner *scanner,

PJ_DEF(int) pj_scan_get_char( pj_scanner *scanner )
{
int chr = *scanner->curptr;
register char *s = scanner->curptr;
int chr;

if (!chr) {
if (s >= scanner->end || !*s) {
pj_scan_syntax_err(scanner);
return 0;
}

++scanner->curptr;
chr = *s;

if (PJ_SCAN_IS_PROBABLY_SPACE(*scanner->curptr) && scanner->skip_ws) {
++s;
scanner->curptr = s;
if (PJ_SCAN_CHECK_EOF(s) && PJ_SCAN_IS_PROBABLY_SPACE(*s) &&
scanner->skip_ws)
{
pj_scan_skip_whitespace(scanner);
}
return chr;
Expand Down

4 comments on commit 077b465

@coolpix3600
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for this CVE. why we modify pj_scan_get_char. why do not modify the content-type function

@sauwming
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We were also considering of modifying the SIP multipart input buffer to create a temporary NULL sentinel within the buffer but decided not to. The downside of the approach is that we need exclusive access to the input buffer (which is currently not mentioned in the doc), so any app currently reading/processing the message at the same time will be affected.

@coolpix3600
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i review the parse_hdr_content_type( ), i guest "content-type: multipart/mixed; " is a malformed sip message, is right? i am not sure pj_scan_get() is ok or not when "content-type: multipart".(no "/" char)

@sauwming
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reported issue was in parse_multipart_part()->pjsip_parse_headers().
If you suspect an issue somewhere else, please open a new PR/issue or send an email to us.

Please sign in to comment.