Summary
Two header-URI extraction helpers slice between the < and > angle brackets
using indices from two independent find() calls, without checking their
order. A header value where > precedes < produces a reversed slice range
(start > end) and panics.
Locations
crates/asterisk-sip/src/parser/mod.rs:858 — extract_uri()
if let Some(start) = header_value.find('<') {
if let Some(end) = header_value.find('>') {
return Some(header_value[start + 1..end].to_string()); // reversed range panic
}
}crates/asterisk-sip/src/event_handler.rs:2135 — extract_user_from_header()
if let Some(start) = header.find('<') {
if let Some(end) = header.find('>') {
&header[start + 1..end] // reversed range panic
} ...
Both are the same defect (copy-paste).
Trigger (malformed input)
Any incoming request whose From/To/Contact header value contains >
before <, e.g.:
find('<') = 6, find('>') = 0 → header_value[7..0] panics:
byte range starts at 7 but ends at 0
(Reproduced against the exact expression on master.)
Reachability — remote DoS (HIGH)
extract_uri is called on From/To/Contact/Refer-To values throughout
dialog/session/refer/pubsub/messaging handling
(e.g. dialog/mod.rs:87 extract_uri(to_hdr)).extract_user_from_header is called on the From and To headers of an
incoming request in event_handler.rs:335 and :345.
Both run inside handle_request(), which is awaited inline in the single main
SIP event loop (stack.rs:737). With the default panic = "unwind", the panic
kills the event-loop task → entire SIP stack DoS from one unauthenticated
request.
Suggested fix
Only slice when start < end; otherwise fall through to the no-brackets path
(or return the raw value). Add regression tests feeding >...< header values
for both functions and asserting a graceful result with no panic.
Summary
Two header-URI extraction helpers slice between the
<and>angle bracketsusing indices from two independent
find()calls, without checking theirorder. A header value where
>precedes<produces a reversed slice range(
start > end) and panics.Locations
crates/asterisk-sip/src/parser/mod.rs:858—extract_uri()crates/asterisk-sip/src/event_handler.rs:2135—extract_user_from_header()Both are the same defect (copy-paste).
Trigger (malformed input)
Any incoming request whose
From/To/Contactheader value contains>before
<, e.g.:find('<')= 6,find('>')= 0 →header_value[7..0]panics:(Reproduced against the exact expression on master.)
Reachability — remote DoS (HIGH)
extract_uriis called onFrom/To/Contact/Refer-Tovalues throughoutdialog/session/refer/pubsub/messaging handling
(e.g.
dialog/mod.rs:87extract_uri(to_hdr)).extract_user_from_headeris called on theFromandToheaders of anincoming request in
event_handler.rs:335and:345.Both run inside
handle_request(), which is awaited inline in the single mainSIP event loop (
stack.rs:737). With the defaultpanic = "unwind", the panickills the event-loop task → entire SIP stack DoS from one unauthenticated
request.
Suggested fix
Only slice when
start < end; otherwise fall through to the no-brackets path(or return the raw value). Add regression tests feeding
>...<header valuesfor both functions and asserting a graceful result with no panic.