[LBBS-120] mod_asterisk_ami: NULL dereference possible if ami_session is currently NULL

← All Issues || New Issue →

Sort Normal || Priority

Details

Most AMI-dependent modules simply call bbs_ami_session() to get the current AMI session, but that can be NULL if we're in the middle of reconnecting, and thus any call during this time would return NULL.

Most, if not all, modules, do not check the return value and pass it to libcami blindly, which expects the session to be non-NULL, thus triggering a segmentation fault:

Segmentation fault (core dumped)

Thread 1 (Thread 0x7effd47f06c0 (LWP 28720)):
#0  ami_action (ami=0x0, action=action@entry=0x7effe8a9c008 "SoftmodemSessions", fmt=fmt@entry=0x7effe8a9c000 "Port:%u") at cami.c:1047
        resp = 0x0
        res = <optimized out>
        actionid = <optimized out>
        ap = {{gp_offset = 1919249508, fp_offset = 538976288, overflow_arg_area = 0x2020202020202020, reg_save_area = 0x2064657472617473}}

It isn't libcami's responsibility to guard against a NULL session, so we will need to avoid this. This and [LBBS-111] may require some refactoring.

A related issue is use after frees are possible since the CAMI session can continue being used after it's been freed:

==197802== Thread 4:
==197802== Invalid read of size 4
==197802==    at 0x5AB0ED6: dprintf (stdio2.h:117)
==197802==    by 0x5AB0ED6: ami_event_dispatch (cami.c:794)
==197802==    by 0x4F3D1F4: start_thread (pthread_create.c:442)
==197802==    by 0x4FBCB3F: clone (clone.S:100)
==197802==  Address 0x6006838 is 72 bytes inside a block of size 136 free'd
==197802==    at 0x484417B: free (vg_replace_malloc.c:872)
==197802==    by 0x56A5B4F: cleanup_ami (mod_asterisk_ami.c:212)
==197802==    by 0x56A5C2B: ami_disconnect_callback (mod_asterisk_ami.c:232)
==197802==    by 0x5AB2C2A: ami_loop (cami.c:342)
==197802==    by 0x4F3D1F4: start_thread (pthread_create.c:442)
==197802==    by 0x4FBCB3F: clone (clone.S:100)
==197802==  Block was alloc'd at
==197802==    at 0x48465EF: calloc (vg_replace_malloc.c:1328)
==197802==    by 0x5AB177B: ami_session_new (cami.c:105)
==197802==    by 0x5AB177B: ami_connect (cami.c:360)
==197802==    by 0x56A605C: load_config (mod_asterisk_ami.c:302)
==197802==    by 0x56A61E9: load_module (mod_asterisk_ami.c:332)
==197802==    by 0x13DF56: start_resource (module.c:773)
==197802==    by 0x13E20A: load_resource (module.c:811)
==197802==    by 0x13F3A1: do_autoload_module (module.c:1135)
==197802==    by 0x13FBB6: try_autoload_modules (module.c:1268)
==197802==    by 0x1416E3: load_modules (module.c:1868)
==197802==    by 0x11EF74: main (bbs.c:1216)
==197802==
==197802== Invalid read of size 4
==197802==    at 0x5AB0D26: ami_event_dispatch (cami.c:822)
==197802==    by 0x4F3D1F4: start_thread (pthread_create.c:442)
==197802==    by 0x4FBCB3F: clone (clone.S:100)
==197802==  Address 0x6006834 is 68 bytes inside a block of size 136 free'd
==197802==    at 0x484417B: free (vg_replace_malloc.c:872)
==197802==    by 0x56A5B4F: cleanup_ami (mod_asterisk_ami.c:212)
==197802==    by 0x56A5C2B: ami_disconnect_callback (mod_asterisk_ami.c:232)
==197802==    by 0x5AB2C2A: ami_loop (cami.c:342)
==197802==    by 0x4F3D1F4: start_thread (pthread_create.c:442)
==197802==    by 0x4FBCB3F: clone (clone.S:100)
==197802==  Block was alloc'd at
==197802==    at 0x48465EF: calloc (vg_replace_malloc.c:1328)
==197802==    by 0x5AB177B: ami_session_new (cami.c:105)
==197802==    by 0x5AB177B: ami_connect (cami.c:360)
==197802==    by 0x56A605C: load_config (mod_asterisk_ami.c:302)
==197802==    by 0x56A61E9: load_module (mod_asterisk_ami.c:332)
==197802==    by 0x13DF56: start_resource (module.c:773)
==197802==    by 0x13E20A: load_resource (module.c:811)
==197802==    by 0x13F3A1: do_autoload_module (module.c:1135)
==197802==    by 0x13FBB6: try_autoload_modules (module.c:1268)
==197802==    by 0x1416E3: load_modules (module.c:1868)
==197802==    by 0x11EF74: main (bbs.c:1216)
==197802==
==197802== Thread 34:
==197802== Invalid read of size 4
==197802==    at 0x5AB0C6A: ami_event_dispatch (cami.c:793)
==197802==    by 0x4F3D1F4: start_thread (pthread_create.c:442)
==197802==    by 0x4FBCB3F: clone (clone.S:100)
==197802==  Address 0x51f89c8 is 72 bytes inside a block of size 136 free'd
==197802==    at 0x484417B: free (vg_replace_malloc.c:872)
==197802==    by 0x56A5B4F: cleanup_ami (mod_asterisk_ami.c:212)
==197802==    by 0x56A5C2B: ami_disconnect_callback (mod_asterisk_ami.c:232)
==197802==    by 0x5AB2C2A: ami_loop (cami.c:342)
==197802==    by 0x4F3D1F4: start_thread (pthread_create.c:442)
==197802==    by 0x4FBCB3F: clone (clone.S:100)
==197802==  Block was alloc'd at
==197802==    at 0x48465EF: calloc (vg_replace_malloc.c:1328)
==197802==    by 0x5AB177B: ami_session_new (cami.c:105)
==197802==    by 0x5AB177B: ami_connect (cami.c:360)
==197802==    by 0x56A605C: load_config (mod_asterisk_ami.c:302)
==197802==    by 0x56A5C35: ami_disconnect_callback (mod_asterisk_ami.c:237)
==197802==    by 0x5AB2C2A: ami_loop (cami.c:342)
==197802==    by 0x4F3D1F4: start_thread (pthread_create.c:442)
==197802==    by 0x4FBCB3F: clone (clone.S:100)

This one is similar but also seems related to [LBBS-121]:

==197802== Thread 22:
==197802== Invalid read of size 4
==197802==    at 0x5AB0C4A: read (unistd.h:38)
==197802==    by 0x5AB0C4A: ami_event_dispatch (cami.c:792)
==197802==    by 0x4F3D1F4: start_thread (pthread_create.c:442)
==197802==    by 0x4FBCB3F: clone (clone.S:100)
==197802==  Address 0x1342df3c is 44 bytes inside a block of size 128 free'd
==197802==    at 0x484417B: free (vg_replace_malloc.c:872)
==197802==    by 0x4DCDF88: ??? (in /usr/lib/x86_64-linux-gnu/libbfd-2.40-system.so)
==197802==    by 0x4E364FC: htab_delete (in /usr/lib/x86_64-linux-gnu/libbfd-2.40-system.so)
==197802==    by 0x4E3F347: ??? (in /usr/lib/x86_64-linux-gnu/libbfd-2.40-system.so)
==197802==    by 0x4D9BEF8: _bfd_elf_close_and_cleanup (in /usr/lib/x86_64-linux-gnu/libbfd-2.40-system.so)
==197802==    by 0x4D727E7: bfd_close_all_done (in /usr/lib/x86_64-linux-gnu/libbfd-2.40-system.so)
==197802==    by 0x11B07C: bt_get_symbols (backtrace.c:225)
==197802==    by 0x11B29F: bbs_log_backtrace (backtrace.c:262)
==197802==    by 0x13308B: __bbs_rwlock_wrlock (lock.c:472)
==197802==    by 0x5D9DAA2: del_agent (mod_asterisk_queues.c:188)
==197802==    by 0x5DA169D: agent_exec (mod_asterisk_queues.c:1190)
==197802==    by 0x127EE9: bbs_door_exec (door.c:130)
==197802==  Block was alloc'd at
==197802==    at 0x484682F: realloc (vg_replace_malloc.c:1437)
==197802==    by 0x4DDDE86: ??? (in /usr/lib/x86_64-linux-gnu/libbfd-2.40-system.so)
==197802==    by 0x4DDEF22: ??? (in /usr/lib/x86_64-linux-gnu/libbfd-2.40-system.so)
==197802==    by 0x4DA7229: _bfd_elf_find_nearest_line_with_alt (in /usr/lib/x86_64-linux-gnu/libbfd-2.40-system.so)
==197802==    by 0x4DA7600: _bfd_elf_find_nearest_line (in /usr/lib/x86_64-linux-gnu/libbfd-2.40-system.so)
==197802==    by 0x11AAE8: process_section (backtrace.c:110)
==197802==    by 0x4D6E85E: bfd_map_over_sections (in /usr/lib/x86_64-linux-gnu/libbfd-2.40-system.so)
==197802==    by 0x11B057: bt_get_symbols (backtrace.c:221)
==197802==    by 0x11B29F: bbs_log_backtrace (backtrace.c:262)
==197802==    by 0x13308B: __bbs_rwlock_wrlock (lock.c:472)
==197802==    by 0x5D9DAA2: del_agent (mod_asterisk_queues.c:188)
==197802==    by 0x5DA169D: agent_exec (mod_asterisk_queues.c:1190)

And this seems to be likely a problem in CAMI itself:

==76233== 1 errors in context 1 of 1:
==76233== Source and destination overlap in memcpy_chk(0x8638ec0, 0x8639047, 2381)
==76233==    at 0x48408F0: __memcpy_chk (vg_replace_strmem.c:1593)
==76233==    by 0x7F33388: memmove (string_fortified.h:40)
==76233==    by 0x7F33388: ami_loop (cami.c:313)
==76233==    by 0x4D1BEA6: start_thread (pthread_create.c:477)
==76233==    by 0x4E31ACE: clone (clone.S:95)

Comments

You must be logged in to leave a comment.