### what i changed 
`replace()` in `src/core/strutils.c` uses a `\d` backreference digit straight
as an index into `pmatch[]`, but the array only has 6 entries (indices 0–5,
`SR_RE_MAX_MATCH`). A `\6`–`\9` token reads past the end of it.

The garbage `regmatch_t` that comes back gives a bad source offset and a
`size = rm_eo - rm_so` that can be negative — and a negative `size` slips
through the `j + size < result->len` check straight into `memcpy()`, where it
turns into a huge length and overflows `result->s`.

This is reachable from outside: the `enum` module passes the `replacement`
straight from a NAPTR record (parsed by `parse_naptr_regexp()`, no validation)
into a fixed `MAX_URI_SIZE` buffer.

Fix just bounds the index (`digit < 6`) and rejects a negative size before the
copy. Valid backreferences behave exactly as before.

Tested with an ASan build — a `\6` replacement trips stack-buffer-overflow
before the patch, clean after. Builds fine with gcc `-Wall`, clang-format clean.

You can view, comment on, or merge this pull request online at:

  https://github.com/kamailio/kamailio/pull/4796

-- Commit Summary --

  * core: strutils - fix out of bounds read in replace()

-- File Changes --

    M src/core/strutils.c (4)

-- Patch Links --

https://github.com/kamailio/kamailio/pull/4796.patch
https://github.com/kamailio/kamailio/pull/4796.diff

-- 
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/4796
You are receiving this because you are subscribed to this thread.

Message ID: <kamailio/kamailio/pull/[email protected]>
_______________________________________________
Kamailio - Development Mailing List -- [email protected]
To unsubscribe send an email to [email protected]
Important: keep the mailing list in the recipients, do not reply only to the 
sender!

Reply via email to