diff mbox series

[net,v3] netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()

Message ID 6a845ebf.38c7cd2a.f0cff.2405@mx.google.com
State Accepted
Headers show
Series [net,v3] netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() | expand

Commit Message

Joas Antonio dos Santos Aug. 18, 2026, 1:31 p.m. UTC 
sip_skip_whitespace() returns dptr unchanged when its own loop
exhausts the buffer (dptr == limit), instead of NULL like its sibling
sip_follow_continuation() returns on its own "no more data" path.

ct_sip_get_header() only checks for NULL after calling it:

  dptr = sip_skip_whitespace(dptr, limit);
  if (dptr == NULL)
          break;
  if (*dptr != ':' || ++dptr >= limit)
          break;

so a recognized header name followed only by spaces/tabs running to
the exact end of the SIP payload, with no colon, makes the very next
statement read one byte past the buffer.

Make both "no more data" outcomes return NULL, matching the
convention sip_follow_continuation() already uses and that both
existing callers already check for.

Fixes: ea45f12a2766d ("[NETFILTER]: nf_conntrack_sip: parse SIP headers properly")
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
---
Testing: 7-byte reproducer ("\r\nTo   ", no colon, buffer ends on
trailing spaces) no longer crashes; 500000-run libFuzzer regression
against a userspace harness linking the unmodified extracted parsing
functions is clean, no behavior change on the existing corpus.
Reproducer bytes available on request.

 net/netfilter/nf_conntrack_sip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 6830c9da3..000000000 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -429,7 +429,7 @@  static const char *sip_skip_whitespace(const char *dptr, const char *limit)
 		dptr = sip_follow_continuation(dptr, limit);
 		break;
 	}
-	return dptr;
+	return dptr < limit ? dptr : NULL;
 }

 /* Search within a SIP header value, dealing with continuation lines */