Matthew Jordan 916a397fc3 AST-2013-001: Prevent buffer overflow through H.264 format negotiation ...

The format attribute resource for H.264 video performs an unsafe read against a
media attribute when parsing the SDP. The value passed in with the format
attribute is not checked for its length when parsed into a fixed length buffer.
This patch resolves the vulnerability by only reading as many characters from
the SDP value as will fit into the buffer.

(closes issue ASTERISK-20901)
Reported by: Ulf Harnhammar
patches:
  h264_overflow_security_patch.diff uploaded by jrose (License 6182)



git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@383973 65c4cc65-6c06-0410-ace0-fbb531ad65f3

2013-03-27 14:26:44 +00:00

..

ael

Clean up and ensure proper usage of alloca()

2012-07-31 20:21:43 +00:00

pjproject

Fix how we build pjproject.

2013-02-04 19:50:52 +00:00

snmp

Multiple revisions 369001-369002

2012-06-15 16:20:16 +00:00

Makefile

Fix how we build pjproject.

2013-02-04 19:50:52 +00:00

res_adsi.c

Multiple revisions 369323-369324

2012-06-25 15:55:25 +00:00

res_ael_share.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

res_ael_share.exports.in

Allow symbol export filtering to work properly on platforms that have symbol prefixes.

2010-04-02 18:57:58 +00:00

res_agi.c

Fix FastAGI To Properly Check For A Connection

2013-02-22 19:38:06 +00:00

res_agi.exports.in

Allow symbol export filtering to work properly on platforms that have symbol prefixes.

2010-04-02 18:57:58 +00:00

res_calendar_caldav.c

Fix a variety of memory leaks

2012-05-18 14:43:44 +00:00

res_calendar_ews.c

Properly extract the Body information of an EWS calendar item

2012-10-31 14:49:33 +00:00

res_calendar_exchange.c

Fix a variety of memory leaks

2012-05-18 14:43:44 +00:00

res_calendar_icalendar.c

Fix memory leak in res_calendar_icalendar

2013-01-30 14:15:27 +00:00

res_calendar.c

Prevent exhaustion of system resources through exploitation of event cache

2013-01-02 18:09:55 +00:00

res_calendar.exports.in

Allow symbol export filtering to work properly on platforms that have symbol prefixes.

2010-04-02 18:57:58 +00:00

res_clialiases.c

Fix crash that can occur if CLI registration fails for an aliased command.

2012-12-11 20:51:47 +00:00

res_clioriginate.c

Allow support for early media on AMI originates and call files.

2012-08-08 22:39:40 +00:00

res_config_curl.c

Properly delimit post data in res_config_curl.

2013-03-25 12:36:33 +00:00

res_config_ldap.c

Avoid cppcheck warnings; removing unused vars and a bit of cleanup.

2012-04-17 18:57:40 +00:00

res_config_odbc.c

Fix coverity UNUSED_VALUE findings in core support level files

2012-06-11 15:23:30 +00:00

res_config_pgsql.c

Clean up and ensure proper usage of alloca()

2012-07-31 20:21:43 +00:00

res_config_sqlite3.c

Avoid cppcheck warnings; removing unused vars and a bit of cleanup.

2012-04-17 18:57:40 +00:00

res_config_sqlite.c

Fix misuses of asprintf throughout the code.

2012-08-21 20:54:19 +00:00

res_convert.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

res_corosync.c

Add a "corosync ping" CLI command.

2012-07-30 00:14:18 +00:00

res_crypto.c

Fix incorrect usage of sizeof() in res_crypto.

2012-03-14 00:39:23 +00:00

res_crypto.exports.in

Remove built-in AES code and use optional_api instead

2010-07-21 19:11:32 +00:00

res_curl.c

Update module support level on a variety of modules and compiler options

2012-08-18 01:08:03 +00:00

res_fax_spandsp.c

res_fax_spandsp: fix t38 transmission bug caused by not returning success

2013-01-22 22:05:14 +00:00

res_fax.c

Ensure ReceiveFax provides a CED tone via T.38

2012-12-10 16:55:05 +00:00

res_fax.exports.in

Log spandsp's fax debug output to the FAX logger level.

2010-05-21 15:15:58 +00:00

res_format_attr_celt.c

Add support for parsing SDP attributes, generating SDP attributes, and passing it through.

2012-07-13 16:49:40 +00:00

res_format_attr_h263.c

Reduce memory consumption and add the H.264 and H.263 modules I shamefully neglected to add.

2012-07-13 18:41:07 +00:00

res_format_attr_h264.c

AST-2013-001: Prevent buffer overflow through H.264 format negotiation

2013-03-27 14:26:44 +00:00

res_format_attr_silk.c

Add support for parsing SDP attributes, generating SDP attributes, and passing it through.

2012-07-13 16:49:40 +00:00

res_http_post.c

Avoid cppcheck warnings; removing unused vars and a bit of cleanup.

2012-04-17 18:57:40 +00:00

res_http_websocket.c

Added missing newlines to websocket ast_logs.

2012-11-20 21:58:35 +00:00

res_http_websocket.exports.in

Fix an issue with res_http_websocket where the chan_sip WebSocket handler could not be registered.

2012-10-31 18:00:32 +00:00

res_jabber.c

Let documentation reference links specify which module they're linking to

2013-01-16 17:45:37 +00:00

res_jabber.exports.in

Fix chan_jingle/gtalk load regression introduced in r346087

2011-12-05 14:47:11 +00:00

res_limit.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

res_monitor.c

monitor: prevent attempts to move/remove recordings skipped with 'i' and 'o'.

2012-11-16 19:59:45 +00:00

res_monitor.exports.in

Allow symbol export filtering to work properly on platforms that have symbol prefixes.

2010-04-02 18:57:58 +00:00

res_musiconhold.c

Refactor ast_timer_ack to return an error and handle the error in timer users

2012-11-05 23:09:30 +00:00

res_mutestream.c

Convert MuteAudio documentation to XML.

2012-03-19 20:26:51 +00:00

res_odbc.c

Ensure that all ast_datastore_info structures are 'const'.

2012-07-18 17:18:20 +00:00

res_odbc.exports.in

Allow symbol export filtering to work properly on platforms that have symbol prefixes.

2010-04-02 18:57:58 +00:00

res_phoneprov.c

Avoid cppcheck warnings; removing unused vars and a bit of cleanup.

2012-04-17 18:57:40 +00:00

res_pktccops.c

Multiple revisions 350788-350789

2012-01-14 15:51:43 +00:00

res_pktccops.exports.in

Allow symbol export filtering to work properly on platforms that have symbol prefixes.

2010-04-02 18:57:58 +00:00

res_realtime.c

Cleanup references to sipusers and sipfriends dynamic realtime families

2011-11-01 19:53:26 +00:00

res_rtp_asterisk.c

Add a 'secret' probation strictrtp mode to handle delayed changes in RTP source

2013-03-07 14:58:23 +00:00

res_rtp_multicast.c

Fix an issue where a caller to ast_write on a MulticastRTP channel would determine it failed when in reality it did not.

2012-09-25 12:07:14 +00:00

res_security_log.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

res_smdi.c

Mark res_smdi/res_adsi as 'core' supported modules

2012-06-13 20:28:07 +00:00

res_smdi.exports.in

Allow symbol export filtering to work properly on platforms that have symbol prefixes.

2010-04-02 18:57:58 +00:00

res_snmp.c

Merged revisions 328247 via svnmerge from

2011-07-14 20:28:54 +00:00

res_speech.c

Fix coverity UNUSED_VALUE findings in core support level files

2012-06-11 15:23:30 +00:00

res_speech.exports.in

Allow symbol export filtering to work properly on platforms that have symbol prefixes.

2010-04-02 18:57:58 +00:00

res_srtp.c

res_srtp: Prevent a crash from occurring due to srtp_create failures in srtp_create

2013-01-04 23:04:59 +00:00

res_srtp.exports.in

Add SRTP support for Asterisk

2010-06-08 05:29:08 +00:00

res_stun_monitor.c

Add 'stun show status' command

2012-07-05 21:36:41 +00:00

res_timing_dahdi.c

Refactor ast_timer_ack to return an error and handle the error in timer users

2012-11-05 23:09:30 +00:00

res_timing_kqueue.c

Refactor ast_timer_ack to return an error and handle the error in timer users

2012-11-05 23:09:30 +00:00

res_timing_pthread.c

Refactor ast_timer_ack to return an error and handle the error in timer users

2012-11-05 23:09:30 +00:00

res_timing_timerfd.c

Refactor ast_timer_ack to return an error and handle the error in timer users

2012-11-05 23:09:30 +00:00

res_xmpp.c

Fix a bug where resources were not found due to hashing on the priority itself.

2013-03-16 15:14:37 +00:00

res_xmpp.exports.in

Add a new unified Jingle, Google Jingle, and Google Talk channel driver written from scratch called chan_motif.

2012-07-07 17:06:51 +00:00