Summary (file-only — out of the panic/UB lane, flagging for a sibling agent)
The AMI connection handler accumulates bytes into an unbounded String
(message_buf) until it sees the \r\n\r\n message terminator. A client that
connects and never sends a blank line — before authenticating — makes the
server buffer arbitrarily much data, a pre-auth memory-exhaustion DoS.
Location
crates/asterisk-ami/src/server.rs:282-321 (handle_connection read loop);
read_message in crates/asterisk-ami/src/protocol.rs:378 only returns once
the terminator is present, with no maximum-length guard.
Impact
Memory-exhaustion DoS, unauthenticated (AMI default binds 127.0.0.1, but is
frequently exposed). Not a panic/UB, so out of the memory-safety hardening lane
I'm working — recording it for the concurrency/DoS-limits agent.
Suggested fix
Cap message_buf length (and per-line length) and drop the connection with an
error when a single message exceeds a sane maximum (Asterisk uses a bounded
manager read buffer). Mirror the MAX_* limits already used in the SIP parser.
Summary (file-only — out of the panic/UB lane, flagging for a sibling agent)
The AMI connection handler accumulates bytes into an unbounded
String(
message_buf) until it sees the\r\n\r\nmessage terminator. A client thatconnects and never sends a blank line — before authenticating — makes the
server buffer arbitrarily much data, a pre-auth memory-exhaustion DoS.
Location
crates/asterisk-ami/src/server.rs:282-321(handle_connectionread loop);read_messageincrates/asterisk-ami/src/protocol.rs:378only returns oncethe terminator is present, with no maximum-length guard.
Impact
Memory-exhaustion DoS, unauthenticated (AMI default binds 127.0.0.1, but is
frequently exposed). Not a panic/UB, so out of the memory-safety hardening lane
I'm working — recording it for the concurrency/DoS-limits agent.
Suggested fix
Cap
message_buflength (and per-line length) and drop the connection with anerror when a single message exceeds a sane maximum (Asterisk uses a bounded
manager read buffer). Mirror the
MAX_*limits already used in the SIP parser.