I'll analyze the sip_get_callid function in the sngrep_2 binary for vulnerabilities.
Function ghidra_open_server called with arguments: {"filepath": "/sandbox/sngrep_2", "reopen": true}
Tool result
[
{
"type": "text",
"text": "Success"
}
]Function ghidra_search_functions_by_name called with arguments: {"filepath": "/sandbox/sngrep_2", "query": "sip_get_callid"}
Tool result
[
{
"type": "text",
"text": "sip_get_callid @ 0010bb60"
}
]Function ghidra_decompile_function called with arguments: {"filepath": "/sandbox/sngrep_2", "name_or_address": "sip_get_callid"}
Tool result
[
{
"type": "text",
"text": "\nchar * sip_get_callid(char *payload,char *callid)\n\n{\n long lVar1;\n int iVar2;\n long in_FS_OFFSET;\n regmatch_t pmatch [3];\n \n lVar1 = *(long *)(in_FS_OFFSET + 0x28);\n iVar2 = regexec((regex_t *)&calls.reg_callid,payload,3,(regmatch_t *)pmatch,0);\n if (iVar2 == 0) {\n strncpy(callid,payload + pmatch[2].rm_so,(long)(pmatch[2].rm_eo - pmatch[2].rm_so));\n }\n if (lVar1 == *(long *)(in_FS_OFFSET + 0x28)) {\n return callid;\n }\n /* WARNING: Subroutine does not return */\n __stack_chk_fail();\n}\n\n"
}
]Function ghidra_get_xrefs_to called with arguments: {"filepath": "/sandbox/sngrep_2", "address": "0010bb60"}
Tool result
[
{
"type": "text",
"text": "From Entry Point [EXTERNAL]"
},
{
"type": "text",
"text": "From 00125038 [INDIRECTION]"
},
{
"type": "text",
"text": "From 001263cc [DATA]"
},
{
"type": "text",
"text": "From 0010d0dd in sip_check_packet [UNCONDITIONAL_CALL]"
}
]Function ghidra_decompile_function called with arguments: {"filepath": "/sandbox/sngrep_2", "name_or_address": "0x0010d0dd"}
Tool result
[
{
"type": "text",
"text": "Function not found"
}
]Function ghidra_decompile_function called with arguments: {"filepath": "/sandbox/sngrep_2", "name_or_address": "sip_check_packet"}
Tool result
[
{
"type": "text",
"text": "\nsip_msg_t * sip_check_packet(packet_t *packet)\n\n{\n long lVar1;\n bool bVar2;\n uint32_t uVar3;\n int iVar4;\n int iVar5;\n u_char *puVar6;\n char *pcVar7;\n sip_msg_t *msg;\n sip_call_t *call;\n sip_call_t *call_00;\n long lVar8;\n long in_FS_OFFSET;\n char callid [1024];\n char xcallid [1024];\n u_char payload [10240];\n \n lVar1 = *(long *)(in_FS_OFFSET + 0x28);\n if (packet->payload_len < 0x2801) {\n pcVar7 = callid;\n for (lVar8 = 0x80; lVar8 != 0; lVar8 = lVar8 + -1) {\n pcVar7[0] = '\\0';\n pcVar7[1] = '\\0';\n pcVar7[2] = '\\0';\n pcVar7[3] = '\\0';\n pcVar7[4] = '\\0';\n pcVar7[5] = '\\0';\n pcVar7[6] = '\\0';\n pcVar7[7] = '\\0';\n pcVar7 = pcVar7 + 8;\n }\n pcVar7 = xcallid;\n for (lVar8 = 0x80; lVar8 != 0; lVar8 = lVar8 + -1) {\n pcVar7[0] = '\\0';\n pcVar7[1] = '\\0';\n pcVar7[2] = '\\0';\n pcVar7[3] = '\\0';\n pcVar7[4] = '\\0';\n pcVar7[5] = '\\0';\n pcVar7[6] = '\\0';\n pcVar7[7] = '\\0';\n pcVar7 = pcVar7 + 8;\n }\n memset(payload,0,0x2800);\n uVar3 = packet_payloadlen(packet);\n puVar6 = packet_payload(packet);\n __memcpy_chk(payload,puVar6,uVar3);\n pcVar7 = sip_get_callid((char *)payload,callid);\n if ((pcVar7 != (char *)0x0) && (msg = msg_create(), msg != (sip_msg_t *)0x0)) {\n iVar4 = sip_get_msg_reqresp(msg,payload);\n if (iVar4 != 0) {\n call = (sip_call_t *)htable_find(calls.callids,callid);\n bVar2 = false;\n if (call != (sip_call_t *)0x0) {\n msg->packet = packet;\n iVar4 = call_msg_count(call);\njoined_r0x0010d27f:\n if (iVar4 == 0) {\n sip_parse_msg_payload(msg,payload);\n if (*call->xcallid != '\\0') {\n call_00 = (sip_call_t *)htable_find(calls.callids,call->xcallid);\n call_add_xcall(call_00,call);\n }\n }\n call_add_message(call,msg);\n call_msg_retrans_check(msg);\n iVar4 = call_is_invite(call);\n if (iVar4 != 0) {\n sip_parse_msg_media(msg,payload);\n call_update_state(call,msg);\n sip_parse_extra_headers(msg,payload);\n iVar4 = call_is_active(call);\n if (iVar4 == 0) {\n iVar4 = vector_index(calls.active,call);\n if (iVar4 != -1) {\n vector_remove(calls.active,call);\n }\n }\n else {\n iVar4 = vector_index(calls.active,call);\n if (iVar4 != -1) {\n vector_append(calls.active,call);\n }\n }\n }\n if (bVar2) {\n vector_append(calls.list,call);\n }\n calls.changed = true;\n goto LAB_0010d17d;\n }\n if ((calls.match_expr == (char *)0x0) ||\n (iVar4 = regexec((regex_t *)&calls.match_regex,(char *)payload,0,(regmatch_t *)0x0,0),\n iVar4 == calls.match_invert)) {\n if (calls.only_calls == 0) {\n if ((calls.ignore_incomplete == 0) || (msg->reqresp < 0xc)) goto LAB_0010d208;\n }\n else if (msg->reqresp == 2) {\nLAB_0010d208:\n sip_get_xcallid((char *)payload,xcallid);\n iVar4 = calls.limit;\n iVar5 = vector_count(calls.list);\n if (iVar4 == iVar5) {\n sip_calls_rotate();\n }\n call = call_create(callid,xcallid);\n if (call != (sip_call_t *)0x0) {\n htable_insert(calls.callids,call->callid,call);\n bVar2 = true;\n calls.last_index = calls.last_index + 1;\n call->index = calls.last_index;\n msg->packet = packet;\n iVar4 = call_msg_count(call);\n goto joined_r0x0010d27f;\n }\n }\n }\n }\n msg_destroy(msg);\n }\n }\n msg = (sip_msg_t *)0x0;\nLAB_0010d17d:\n if (lVar1 != *(long *)(in_FS_OFFSET + 0x28)) {\n /* WARNING: Subroutine does not return */\n __stack_chk_fail();\n }\n return msg;\n}\n\n"
}
]Vulnerability Found: Buffer Overflow in sip_get_callid
Function: sip_get_callid at 0x0010bb60
Vulnerability Type: Buffer Overflow (CWE-120)
Critical Issue:
strncpy(callid, payload + pmatch[2].rm_so, (long)(pmatch[2].rm_eo - pmatch[2].rm_so));
Problem:
strncpycopies(rm_eo - rm_so)bytes without validating againstcallidbuffer size- Caller allocates
callid[1024]but regex match length is unchecked - No null termination guaranteed if match length ≥ buffer size
Attack Vector:
- Attacker sends SIP packet with Call-ID header > 1024 bytes
- Regex matches entire malicious Call-ID
strncpyoverflowscallidbuffer on stack- Overwrites return address or adjacent variables
CVSS Score: 9.8 (Critical)
- Network exploitable, no authentication required
- Potential for arbitrary code execution
- Affects packet processing path
Mitigation:
size_t len = pmatch[2].rm_eo - pmatch[2].rm_so;
if (len >= sizeof(callid)) len = sizeof(callid) - 1;
strncpy(callid, payload + pmatch[2].rm_so, len);
callid[len] = '\0';