diff options
-rw-r--r-- | net/netfilter/nf_conntrack_sip.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c index 621b81c7bddc..c3fc14e021ec 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c | |||
@@ -1436,9 +1436,12 @@ static int process_sip_request(struct sk_buff *skb, unsigned int protoff, | |||
1436 | handler = &sip_handlers[i]; | 1436 | handler = &sip_handlers[i]; |
1437 | if (handler->request == NULL) | 1437 | if (handler->request == NULL) |
1438 | continue; | 1438 | continue; |
1439 | if (*datalen < handler->len || | 1439 | if (*datalen < handler->len + 2 || |
1440 | strncasecmp(*dptr, handler->method, handler->len)) | 1440 | strncasecmp(*dptr, handler->method, handler->len)) |
1441 | continue; | 1441 | continue; |
1442 | if ((*dptr)[handler->len] != ' ' || | ||
1443 | !isalpha((*dptr)[handler->len+1])) | ||
1444 | continue; | ||
1442 | 1445 | ||
1443 | if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ, | 1446 | if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ, |
1444 | &matchoff, &matchlen) <= 0) { | 1447 | &matchoff, &matchlen) <= 0) { |