Skip to content

[mod_amqp] implement dynamic mem alloc for longer messages to prevent buffer overflow #2982

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mahald wants to merge 1 commit into
base: master
Choose a base branch
from
+29 −3
Open

[mod_amqp] implement dynamic mem alloc for longer messages to prevent buffer overflow #2982

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 29 additions & 3 deletions src/mod/event_handlers/mod_amqp/mod_amqp_command.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -387,7 +387,8 @@ void * SWITCH_THREAD_FUNC mod_amqp_command_thread(switch_thread_t *thread, void
amqp_rpc_reply_t res;
amqp_envelope_t envelope;
struct timeval timeout = {0};
char command[10240];
char *command = NULL;
char stack_buffer[10240]; // Pre-allocated stack buffer for typical cases
enum ECommandFormat {
COMMAND_FORMAT_UNKNOWN,
COMMAND_FORMAT_PLAINTEXT
Expand Down Expand Up @@ -469,9 +470,28 @@ void * SWITCH_THREAD_FUNC mod_amqp_command_thread(switch_thread_t *thread, void

if (commandFormat == COMMAND_FORMAT_PLAINTEXT) {
switch_stream_handle_t stream = { 0 }; /* Collects the command output */
size_t command_len = envelope.message.body.len + 1; // +1 for null terminator

/* Use stack buffer by default, only allocate from heap if message is larger */
if (command_len > sizeof(stack_buffer)) {
command = malloc(command_len);
if (!command) {
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_ERROR,
"Memory allocation failed for command of size %zu bytes\n",
command_len);
amqp_destroy_envelope(&envelope);
continue;
}
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_INFO,
"Large AMQP command received: %zu bytes, using heap allocation\n",
envelope.message.body.len);
} else {
/* Use stack buffer for typical case - zero allocation overhead */
command = stack_buffer;
}

/* Convert amqp bytes to c-string */
snprintf(command, sizeof(command), "%.*s", (int) envelope.message.body.len, (char *) envelope.message.body.bytes);
/* Convert amqp bytes to c-string with null termination */
snprintf(command, command_len, "%.*s", (int)(command_len - 1), (char *) envelope.message.body.bytes);

/* Execute the command */
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_INFO, "Executing: %s\n", command);
Expand All @@ -491,6 +511,12 @@ void * SWITCH_THREAD_FUNC mod_amqp_command_thread(switch_thread_t *thread, void
switch_safe_free(stream.data);
}

/* Clean up - only free if we allocated from heap */
if (command != stack_buffer) {
free(command);
}
command = NULL;

/* Tidy up */
amqp_destroy_envelope(&envelope);
}
Expand Down