From nobody Mon Sep 28 23:06:40 2026 Received: from mail-pg1-f176.google.com (mail-pg1-f176.google.com [209.85.215.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 260BB2DC79B for ; Sat, 15 Aug 2026 13:31:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786800689; cv=none; b=K/ftKWlJ9xuPxzz7oslgFPBhgRQ86lFVamXLNrf7GqhGx7eIzsKzH3NtZF9NjdnPFmMZ2hsjDPpvjMdm1PSUVt2aWKc4V69KNeOy+cMoVIkFh7wtWFmRqQu8BsBLVortwD8PAdataeGg6DduAuOS9amOQ56XonPflw2DoHHwn+M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786800689; c=relaxed/simple; bh=ffXPqKdSIu9gxybAgPMX1CVXHu2WOyg410kZcmMe408=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=rrfI98wBWtU8gye6Wfymhk+YI0VkM8sZE69G7c1M5S1AeW7SwWhcz3LYmCK36JDfxRrJdy8nP2nHEbDJvqDaXL+K/Ko6psb3hjBeWda/UKLkdNF1hyBk8Lf3KHQRzc0jVxiy6qiWbXz030OfxnLdi7hwVCPEMwIPRofHSrcEJRw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=M+yzGkoi; arc=none smtp.client-ip=209.85.215.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="M+yzGkoi" Received: by mail-pg1-f176.google.com with SMTP id 41be03b00d2f7-cbed97fa26fso1194194a12.0 for ; Sat, 15 Aug 2026 06:31:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786800686; x=1787405486; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Xxe+qK628pSv5aRz3Z60BtjyzpuZLQOeH8bhyQjGgxI=; b=M+yzGkoibBNBFeNxtACKk5HkYdv00BtxVpwW2G6GoyzGvqHPTphQHkUm/s83wpRt5q f/PbSQeBd6uyobkuvcIBWbhba4q7PXwOlei60LSIKZHHSZ3lG8dHulgNYX6EnmZj5CjW DoB43A8WJO5UU1PXZm1cJu6V0KWzEnXX7sEbDwDSGN0OsEvNiUBGiK5lrvhLczUYDHyX mojF6FSnCY5Aar0BK0/oCLHh0YlQPpH4W8CHTBnb8gG8J4Qc0isQiv34X1KkC5ZzBc+P CZngQAS0rV5IAbxRzLeHqTVopyZje/SjZflBYGQGERbgI6ij6rIwi2wpBKJ/WGJviNwD +rzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786800686; x=1787405486; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Xxe+qK628pSv5aRz3Z60BtjyzpuZLQOeH8bhyQjGgxI=; b=dQ0lit9nz1eO1wwGfufpqDvKvdkneaCnaOID5BrRHXqgW1EoNHOn9dfLE7qz58XE7U vwoU8mlo5+f5qSH7zm0r9c46Y1UPKWzv38lnU48IT8y2rQMBRk3WfCsVkBGa5mFSqoeo KRuKfiA/IVAwbj8o8qXUQNiJSiR/fSsyAa6schTguzGXPXVGTlekvclqoHTDYxbjNRnn kBiYpYWTl8ZaJQdhtKopfSoZKGoJuNYrNYx3ms9aw8Elnmmk34kAFXowewWjvkBbBIiy /2/89+5F8gcdrCkmKKEryNvhkjqoPC3S4UVfc2IdMgO+tvZPHzoPYHBjKt7edlk+c1u6 /YjQ== X-Forwarded-Encrypted: i=1; AHgh+Rotw6XZqB9tfwWWI8RRTY5mzqLkLUWF4Sqa7Vfz81CPGcKmqicS7RcF6ZTWojRQvrKeIVfEPLifYwGiVm8=@vger.kernel.org X-Gm-Message-State: AOJu0Ywb3wJh/MmAe8l2jIrLUojX9+3L+pfcpfEeWP9FxoZe+yORTR// FZlvqNSW3r1nCvqC37nlNQ0e8y8OJIb2HoDp00dparx+GLlD5tQefhxOuKid4DZe X-Gm-Gg: AR+sD10arh0qpW+g+uW/xXkAQia3KvUrajSXs/m/JueDv9csdJM1PtgJlyY3L3b4CYv BEjRP+9WjMBBQkWhGeFsk0RCyinU85vm2IweZjI2wcINxB2qeCcNL5/S6OBhxrYiKXpI68qWNdy 6GjDPhT8lhW0rK5G80JBlp2mg4uYU6dpC+QgavDO/xV++FmDrs/S3ohMYcdBBAl0wCLLU3oO6DQ eQQUovRQYpnILdnp6BZQkaofIs+oyXsC9EApX8IPmdITWp+MQRYguJDv6ijvh8GrhiGjyv6PnHH UHhjw+A+sfOUauSxjnqMFvj6REnRl2LFFIBd3hOpinxvNJ+54GgXV0fbkZ+cmBjvSH1wMEsHqCQ MZsSoye1mJbwcZRM9zERJLpDb7Qk6Eokmcu7aKdVnlpewFjpN/tam9KyZNZJTiECmC7a/ORxHL6 HP8pJAjm/Lw8PwWW6/FIeh00PizWqOSKgdnAckrpUQV1nvlpTcDiRgL12uX9iFYNhmr1LWsAY8Y 3BsDafyD2v8lirLUYPBll5Cfj6qEWDndd27f+o23n/n6dCE X-Received: by 2002:a17:90b:5445:b0:380:8bb9:aba9 with SMTP id 98e67ed59e1d1-3931f450eb6mr16557155a91.3.1786800686259; Sat, 15 Aug 2026 06:31:26 -0700 (PDT) Received: from localhost.localdomain ([103.75.11.105]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-320d5ff42b7sm17854020eec.7.2026.08.15.06.31.17 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 15 Aug 2026 06:31:25 -0700 (PDT) From: Joas Antonio dos Santos To: pablo@netfilter.org, fw@strlen.de Cc: phil@nwl.cc, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Joas Antonio dos Santos Subject: [PATCH net] netfilter: nf_conntrack_sip: fix OOB read in ct_sip_parse_transport() Date: Sat, 15 Aug 2026 10:31:04 -0300 Message-Id: <20260815133104.50369-1-joasantonio108@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" ct_sip_parse_transport() compares the value of the "transport=3D" header parameter against "TCP"/"UDP" with strncasecmp(..., 3), but it never checks that the parsed value is at least 3 bytes long. ct_sip_parse_param() returns matchlen =3D end - start, where end is the next ';' or, when there is no ';', the end of the payload buffer (limit =3D dptr + datalen). If the "transport=3D" value is only 1 or 2 bytes long and runs exactly to the end of the payload (e.g. a REGISTER request whose Contact header ends in ";transport=3DT" with no trailing CRLF), matchlen is less than 3 while strncasecmp() still reads up to 3 bytes, reading 1-2 bytes past the end of the linearized skb data. Add a matchlen check before the comparison, mirroring the sdp_media_type() pattern a few lines below, so short values cannot reach strncasecmp(). Fixes: ea45f12a2766 ("[NETFILTER]: nf_conntrack_sip: parse SIP headers prop= erly") Signed-off-by: Joas Antonio dos Santos --- net/netfilter/nf_conntrack_sip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_= sip.c index e4a70d1d7..f3b1d6356 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -707,9 +707,9 @@ static int ct_sip_parse_transport(struct nf_conn *ct, c= onst char *dptr, =20 if (ct_sip_parse_param(ct, dptr, dataoff, datalen, "transport=3D", &matchoff, &matchlen)) { - if (!strncasecmp(dptr + matchoff, "TCP", strlen("TCP"))) + if (matchlen >=3D 3 && !strncasecmp(dptr + matchoff, "TCP", 3)) *proto =3D IPPROTO_TCP; - else if (!strncasecmp(dptr + matchoff, "UDP", strlen("UDP"))) + else if (matchlen >=3D 3 && !strncasecmp(dptr + matchoff, "UDP", 3)) *proto =3D IPPROTO_UDP; else return 0; --=20 2.39.5 (Apple Git-154)