Subject: [Sip] Bug in RFC 3261 Reason-Phrase BNF

From: Jonathan Lennox <[email-masked]>
Date: Wed, 5 May 2004 16:03:34 -0400

RFC 3261 defines the grammar for Reason-Phrase as follows:

   Reason-Phrase   =  *(reserved / unreserved / escaped
                       / UTF8-NONASCII / UTF8-CONT / SP / HTAB)

I believe the inclusion of UTF8-CONT here is wrong: the UTF8-NONASCII
production includes all valid multi-byte UTF-8 strings, including all
contexts in which UTF8-CONT characters can appear.  Allowing spurious extra
UTF8-CONT characters in reason phrases, outside the context of
UTF8-NONASCII, leads to invalid UTF-8 strings.

The grammar header header-value (a generic value from an extension-header)
is similarly wrong:

   header-value      =  *(TEXT-UTF8char / UTF8-CONT / LWS)

as TEXT-UTF8char also already includes UTF8-CONT.  (If the idea is to allow
any non-ASCII character, so as to e.g. allow extensions using non-unicode
encodings, a different grammar would be needed.  This one doesn't do that.)

Another note on UTF-8: RFC 3629 (STD 63) gives a BNF grammar describing
UTF-8 which is stricter than the one given in RFC 3261.  Specifically, the
grammar explicitly forbids overlong encodings, e.g. using C0 80 to encode a
null byte.  (This sort of thing can have security consequences, because an
attacker can use it to sneak forbidden characters past your parser.)  It
also forbids encoding the UTF-16 surrogate pairs, or any character greater
than U+0x10FFFF.  So any future revision of the SIP spec ought to change its
UTF-8 BNF to copy or cite the one in 3629.

-- 
Jonathan Lennox
[email-masked]

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip