diff options
| author | Patrick McHardy <kaber@trash.net> | 2011-05-16 14:42:26 +0200 |
|---|---|---|
| committer | Patrick McHardy <kaber@trash.net> | 2011-05-16 14:42:26 +0200 |
| commit | 274ea0e2a4cdf18110e5931b8ecbfef6353e5293 (patch) | |
| tree | d8d78f730253a0bd77a5e17557f4552005ba539b | |
| parent | 74973f6fbfcd1b084c3ccc75b783a6dacac94a10 (diff) | |
| download | linux-stable-274ea0e2a4cdf18110e5931b8ecbfef6353e5293.tar.gz linux-stable-274ea0e2a4cdf18110e5931b8ecbfef6353e5293.tar.bz2 linux-stable-274ea0e2a4cdf18110e5931b8ecbfef6353e5293.zip | |
netfilter: nf_ct_sip: validate Content-Length in TCP SIP messages
Verify that the message length of a single SIP message, which is calculated
based on the Content-Length field contained in the SIP message, does not
exceed the packet boundaries.
Signed-off-by: Patrick McHardy <kaber@trash.net>
| -rw-r--r-- | net/netfilter/nf_conntrack_sip.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c index bcf47eb518ef..1f81abde131f 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -1461,6 +1461,8 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff, end += strlen("\r\n\r\n") + clen; msglen = origlen = end - dptr; + if (msglen > datalen) + return NF_DROP; ret = process_sip_msg(skb, ct, dataoff, &dptr, &msglen); if (ret != NF_ACCEPT) |