netfilter: nf_ct_sip: validate Content-Length in TCP SIP messages

Verify that the message length of a single SIP message, which is calculated
based on the Content-Length field contained in the SIP message, does not
exceed the packet boundaries.

Signed-off-by: Patrick McHardy <kaber@trash.net>

1 files changed, 2 insertions, 0 deletions

diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index bcf47eb518ef..1f81abde131f 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1461,6 +1461,8 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
                 end += strlen("\r\n\r\n") + clen;
 
                 msglen = origlen = end - dptr;
+                if (msglen > datalen)
+                        return NF_DROP;
 
                 ret = process_sip_msg(skb, ct, dataoff, &dptr, &msglen);
                 if (ret != NF_ACCEPT)