From: Patrick McHardy Date: Mon, 16 May 2011 12:42:26 +0000 (+0200) Subject: netfilter: nf_ct_sip: validate Content-Length in TCP SIP messages X-Git-Tag: v3.0-rc1~377^2~38^2~4^2~1 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=274ea0e2a4cdf18110e5931b8ecbfef6353e5293;p=platform%2Fkernel%2Flinux-3.10.git netfilter: nf_ct_sip: validate Content-Length in TCP SIP messages Verify that the message length of a single SIP message, which is calculated based on the Content-Length field contained in the SIP message, does not exceed the packet boundaries. Signed-off-by: Patrick McHardy --- diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c index bcf47eb..1f81abd 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -1461,6 +1461,8 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff, end += strlen("\r\n\r\n") + clen; msglen = origlen = end - dptr; + if (msglen > datalen) + return NF_DROP; ret = process_sip_msg(skb, ct, dataoff, &dptr, &msglen); if (ret != NF_ACCEPT)