Summary
extract_uri panics when a header value contains > before <, crashing the request-handling path (dialog creation, registrar, ACL) on attacker-controlled header input.
Location
crates/asterisk-sip/src/parser/mod.rs, extract_uri (~line 855):
if let Some(start) = header_value.find('<') {
if let Some(end) = header_value.find('>') {
return Some(header_value[start + 1..end].to_string()); // end may be < start
}
}
find('>') returns the first > in the whole value. If it appears before the <, then end < start and header_value[start+1..end] is a reversed range, which panics (byte range starts at N but ends at M).
Hostile input
A quoted display-name legally contains >:
From: "evil>name" <sip:carol@example.com>;tag=1
Here the first > (inside the quotes) precedes the URI <, so end < start -> panic.
Reachability (request path, untrusted)
dialog/mod.rs:77,83,87,135,138 — dialog creation from From/To of an incoming request
registrar.rs:433 — REGISTER To (AoR)
acl.rs:239 — Contact
session/mod.rs:279, messaging.rs, diversion.rs, refer.rs
All called inline from the stack event loop, so the panic aborts the SIP receive loop -> DoS.
Fix
Search for > only in the tail after < (also more correct: it matches the bracket that closes the URI). PR incoming with a RED-capable regression test.
Axis
SIP parsing robustness / DoS (malformed From/To/Contact).
Summary
extract_uripanics when a header value contains>before<, crashing the request-handling path (dialog creation, registrar, ACL) on attacker-controlled header input.Location
crates/asterisk-sip/src/parser/mod.rs,extract_uri(~line 855):find('>')returns the first>in the whole value. If it appears before the<, thenend < startandheader_value[start+1..end]is a reversed range, which panics (byte range starts at N but ends at M).Hostile input
A quoted display-name legally contains
>:Here the first
>(inside the quotes) precedes the URI<, soend < start-> panic.Reachability (request path, untrusted)
dialog/mod.rs:77,83,87,135,138— dialog creation from From/To of an incoming requestregistrar.rs:433— REGISTER To (AoR)acl.rs:239— Contactsession/mod.rs:279,messaging.rs,diversion.rs,refer.rsAll called inline from the stack event loop, so the panic aborts the SIP receive loop -> DoS.
Fix
Search for
>only in the tail after<(also more correct: it matches the bracket that closes the URI). PR incoming with a RED-capable regression test.Axis
SIP parsing robustness / DoS (malformed From/To/Contact).