From: Patrick McHardy Date: Mon, 16 May 2011 12:42:26 +0000 (+0200) Subject: netfilter: nf_ct_sip: validate Content-Length in TCP SIP messages X-Git-Tag: v2.6.39.1~115 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fa8c3f668b17e2e508d14f44bbf8368b3d7ea92e;p=thirdparty%2Fkernel%2Fstable.git netfilter: nf_ct_sip: validate Content-Length in TCP SIP messages [ Upstream commit 274ea0e2a4cdf18110e5931b8ecbfef6353e5293 ] Verify that the message length of a single SIP message, which is calculated based on the Content-Length field contained in the SIP message, does not exceed the packet boundaries. Signed-off-by: Patrick McHardy Signed-off-by: Greg Kroah-Hartman --- diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c index 237cc1981b891..3fed15e825122 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -1461,6 +1461,8 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff, end += strlen("\r\n\r\n") + clen; msglen = origlen = end - dptr; + if (msglen > datalen) + return NF_DROP; ret = process_sip_msg(skb, ct, dataoff, &dptr, &msglen); if (ret != NF_ACCEPT)