DoS: SIP parser panics on Content-Length that splits a UTF-8 character (single UDP packet kills the stack)

[ryanmurf]

Summary

A single malformed SIP datagram panics parse_message, and because SipStack::run awaits transport.recv() (which calls the parser) inline, the panic aborts the entire SIP receive loop. Remote, unauthenticated, one packet -> total SIP DoS.

Location

crates/asterisk-sip/src/parser/mod.rs, parse_message (body extraction, ~line 792):

if cl > 0 && body.len() >= cl {
    body[..cl].to_string()   // <-- panics if cl is not a UTF-8 char boundary
}

body is a &str (the whole message is UTF-8-validated up front). Slicing a &str at a byte index that lands inside a multi-byte character panics with byte index N is not a char boundary.

Hostile input

INVITE sip:bob@example.com SIP/2.0\r\n...\r\nContent-Length: 1\r\n\r\n<0xC3 0xA9>...

i.e. Content-Length: 1 with a body whose first character is the 2-byte UTF-8 é (0xC3 0xA9). body.len() (>=2) >= cl (1), so body[..1] slices inside é and panics.

Impact

Remote unauthenticated DoS. UdpTransport::recv -> SipMessage::parse -> panic; the SipStack::run event loop future panics and the whole SIP task dies. RFC 3261 §20.14 (Content-Length must equal the body octet count) — a disagreeing value must be handled, not crash.

Fix

Reject when !body.is_char_boundary(cl). PR incoming with a RED-capable regression test.

Axis

SIP parsing robustness / DoS (Content-Length disagrees with body).

[github-actions]

🤖 Auto-triage: Automated evaluation failed. A human should review this issue.

Error

GitHub Models API returned 401: {"error":{"code":"unauthorized","message":"Bad credentials","details":"Bad credentials"}}

[ryanmurf]

Duplicate of #108 — the Content-Length char-boundary panic was fixed independently by #113 (uses body.get(..cl)). Confirmed present on master. Closing; the distinct extract_uri panic I found alongside it is tracked in #114 / PR #118.