[ Upstream commit
274ea0e2a4cdf18110e5931b8ecbfef6353e5293 ]
Verify that the message length of a single SIP message, which is calculated
based on the Content-Length field contained in the SIP message, does not
exceed the packet boundaries.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
end += strlen("\r\n\r\n") + clen;
msglen = origlen = end - dptr;
+ if (msglen > datalen)
+ return NF_DROP;
ret = process_sip_msg(skb, ct, dataoff, &dptr, &msglen);
if (ret != NF_ACCEPT)