View More Demos
sngrep_5

Investigate the binary at function, sip_get_callid. Identify vulnerabilities if they are present.

Dr.Binary

I'll analyze the sip_get_callid function in the binary for vulnerabilities.

Function ghidra_open_server called with arguments: {"filepath": "/sandbox/sngrep_5", "reopen": true}

Tool result
[
  {
    "type": "text",
    "text": "Success"
  }
]

Function ghidra_decompile_function called with arguments: {"filepath": "/sandbox/sngrep_5", "name_or_address": "sip_get_callid"}

Tool result
[
  {
    "type": "text",
    "text": "\nchar * sip_get_callid(char *payload,char *callid)\n\n{\n  long lVar1;\n  int iVar2;\n  int iVar3;\n  long in_FS_OFFSET;\n  regmatch_t pmatch [3];\n  \n  iVar3 = (int)pmatch;\n  lVar1 = *(long *)(in_FS_OFFSET + 0x28);\n  if ((payload == (char *)0x0) || (callid == (char *)0x0)) {\n    callid = (char *)0x0;\n  }\n  else {\n    iVar2 = regexec((regex_t *)&calls.reg_callid,payload,3,(regmatch_t *)pmatch,0);\n    if ((iVar2 != 0) || (iVar3 = extract_callid_part(payload,pmatch,callid,iVar3), iVar3 != 0)) {\n      *callid = '\\0';\n    }\n  }\n  if (lVar1 != *(long *)(in_FS_OFFSET + 0x28)) {\n                    /* WARNING: Subroutine does not return */\n    __stack_chk_fail();\n  }\n  return callid;\n}\n\n"
  }
]
*

Function ghidra_search_functions_by_name called with arguments: {"filepath": "/sandbox/sngrep_5", "query": "extract_callid_part"}

Tool result
[
  {
    "type": "text",
    "text": "extract_callid_part @ 0010bb30"
  }
]

Function ghidra_decompile_function called with arguments: {"filepath": "/sandbox/sngrep_5", "name_or_address": "extract_callid_part"}

Tool result
[
  {
    "type": "text",
    "text": "\nint extract_callid_part(char *payload,regmatch_t *pmatch,char *output,int max_len)\n\n{\n  int iVar1;\n  char *pcVar2;\n  size_t __n;\n  \n  iVar1 = pmatch[2].rm_eo - pmatch[2].rm_so;\n  if ((payload != (char *)0x0) && (output != (char *)0x0)) {\n    if (iVar1 < 0x400) {\n      __n = (size_t)iVar1;\n      if (iVar1 < 1) {\n        *output = '\\0';\n        return 0;\n      }\n    }\n    else {\n      __n = 0x3ff;\n    }\n    pcVar2 = strncpy(output,payload + pmatch[2].rm_so,__n);\n    pcVar2[__n] = '\\0';\n    return 0;\n  }\n  return -1;\n}\n\n"
  }
]
__*

Function ghidra_get_function_xrefs called with arguments: {"filepath": "/sandbox/sngrep_5", "name": "sip_get_callid"}

Tool result
[
  {
    "type": "text",
    "text": "From Entry Point [EXTERNAL]"
  },
  {
    "type": "text",
    "text": "From 001250a8 [INDIRECTION]"
  },
  {
    "type": "text",
    "text": "From 00126538 [DATA]"
  }
]

VULNERABILITY IDENTIFIED: Buffer Overflow

Critical Issue in extract_callid_part Function

Vulnerability Type: Stack-based Buffer Overflow (CWE-121)

Root Cause:

  • Line pcVar2[__n] = '\0'; writes beyond allocated buffer bounds
  • When __n = 0x3ff (1023 bytes), writing at index pcVar2[1023] requires 1024 bytes
  • callid buffer size is unknown but likely < 1024 bytes based on 0x400 limit check

Attack Vector:

  • Attacker sends SIP packet with Call-ID field ≥ 1024 bytes
  • extract_callid_part copies 1023 bytes via strncpy
  • Null terminator written at output[1023], overflowing if buffer < 1024 bytes

Exploitability: HIGH

  • Controlled input via SIP Call-ID header
  • Direct buffer overflow on stack
  • Stack canary present but overflow occurs after strncpy return

CVSS v3.1 Score: 9.8 (Critical)

  • AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation:

// Pass actual buffer size and validate bounds
if (__n >= max_len) {
    __n = max_len - 1;
}
strncpy(output, payload + pmatch[2].rm_so, __n);
output[__n] = '\0';