Skip to content

DoS: extract_uri panics on a From/To/Contact header with '>' before '<' (reversed byte range) #114

Description

@ryanmurf

Summary

extract_uri panics when a header value contains > before <, crashing the request-handling path (dialog creation, registrar, ACL) on attacker-controlled header input.

Location

crates/asterisk-sip/src/parser/mod.rs, extract_uri (~line 855):

if let Some(start) = header_value.find('<') {
    if let Some(end) = header_value.find('>') {
        return Some(header_value[start + 1..end].to_string()); // end may be < start
    }
}

find('>') returns the first > in the whole value. If it appears before the <, then end < start and header_value[start+1..end] is a reversed range, which panics (byte range starts at N but ends at M).

Hostile input

A quoted display-name legally contains >:

From: "evil>name" <sip:carol@example.com>;tag=1

Here the first > (inside the quotes) precedes the URI <, so end < start -> panic.

Reachability (request path, untrusted)

  • dialog/mod.rs:77,83,87,135,138 — dialog creation from From/To of an incoming request
  • registrar.rs:433 — REGISTER To (AoR)
  • acl.rs:239 — Contact
  • session/mod.rs:279, messaging.rs, diversion.rs, refer.rs

All called inline from the stack event loop, so the panic aborts the SIP receive loop -> DoS.

Fix

Search for > only in the tail after < (also more correct: it matches the bracket that closes the URI). PR incoming with a RED-capable regression test.

Axis

SIP parsing robustness / DoS (malformed From/To/Contact).

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions