netfilter: nf_ct_sip: validate Content-Length in TCP SIP messages
authorPatrick McHardy <kaber@trash.net>
Mon, 16 May 2011 12:42:26 +0000 (14:42 +0200)
committerGreg Kroah-Hartman <gregkh@suse.de>
Fri, 3 Jun 2011 00:31:52 +0000 (09:31 +0900)
[ Upstream commit 274ea0e2a4cdf18110e5931b8ecbfef6353e5293 ]

Verify that the message length of a single SIP message, which is calculated
based on the Content-Length field contained in the SIP message, does not
exceed the packet boundaries.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
net/netfilter/nf_conntrack_sip.c

index 237cc19..3fed15e 100644 (file)
@@ -1461,6 +1461,8 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
                end += strlen("\r\n\r\n") + clen;
 
                msglen = origlen = end - dptr;
+               if (msglen > datalen)
+                       return NF_DROP;
 
                ret = process_sip_msg(skb, ct, dataoff, &dptr, &msglen);
                if (ret != NF_ACCEPT)