From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E4A913CF699 for ; Thu, 9 Apr 2026 15:07:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775747270; cv=none; b=XPngYc4cWjsd2BapUTTVAYDSzDRor97mFBjxSaJKAtXNUtQvZtlCXy29UgL2yJSvohhCmJiJbxKvFcV+pLdf7PPifJ1D2oG0dHx+gYWJD3GhwFl9cYMrpLASuT89CYHJMwb4K6tL8w7Z16tHSJ4Nry7JeJ57WHm0dHkl067n198= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775747270; c=relaxed/simple; bh=Tzx1JoLPABShYM1Pm3RTCn9DyXuxVz/UCK8Zh9PzwWQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=DHQYHbEDB9RJNa5937e//8VpCMLUN8LDVOtjmrEkz3SmP43TgVa4kkCS8Hrryd0J+gytHYxJ2CKJURY0CarGNgPsVNUZ+IFTFH1qyoQf83NVCj/Qm4LBQWHBYgU1gMjN1+5xbmPYbzy/nekDzZxY/z+3CVABhb+I61U1oMZVfr8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=K1NYr8nc; arc=none smtp.client-ip=209.85.214.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="K1NYr8nc" Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2b24fcc2b5dso7814515ad.1 for ; Thu, 09 Apr 2026 08:07:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775747267; x=1776352067; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=PrEq8JFBlKt4BxwmLLBZiPMRBW9tfYXXYLLd/dH/SyE=; b=K1NYr8ncZ7rDgEspHQQy3QHmOK2zePYvr1Y/8hWeYphQM8gDSZO73Px+8E7JCfZ+8f 5pb+QBGtVyQX0HJgArVXV7MhpjCIqfnNYR3s71h5cEfxiOK4FhQXnJV0Qhsn6dJrSzQv gYq7DUaLSop3GgBGksn7MEJdEJ0ZPnjJ4DHpSUGRJLyTn4qg1qg6leTAzcSppzGctOJq VHVpqtmqyBbPUdToOPr/EcVfgGpFlU4CM10/CctapHwjpbatQ2ScoZ1ka3lOwwPmsg45 LzP8wLgXIxF+qYEbSEvoNUvEMsR9xFpdwaKFWhflad4bC4ogrQuy+/CHd6mMKrMPD4O8 RivA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775747267; x=1776352067; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=PrEq8JFBlKt4BxwmLLBZiPMRBW9tfYXXYLLd/dH/SyE=; b=RCiETfJ0B0Gd3jKO3jxFac65QUcNlgu8SNXQ93NeM9cD6+HgiIVYCG0Eie5ks+JwIr Y00AQkksF+51Noi4wPhxss8QFVSY/QIhbvZDkY8k+ZlpQXO5uNzRHsoKYPFmzBT3nS0J XNyKmWzFLFTnr0rmjQ2aE6PavnbM0ch4JDjyK70+pmhOrEsUm/xgaiBKiMVPbNZ124uD NxmfFHU7LJRcbu2G+5z8YiljZuKPeIbAr7T/lYz0HyJ+hyN5hI4Yt4Y7+d3n9uxoXSeM OYLISt2/l9qB96vmf16dv0LEvJZSxJa+sBodHnjUfTuWXNY6CCF5mgvkaf/F0wrFdn9U eXvg== X-Forwarded-Encrypted: i=1; AJvYcCW+h4m3gMv7W5HrYkqoTbLMnnQE85Ab/64/9ltoY1xePiOo14fpcocW+e89jFasnJpjkSnRsmU+CCxLcEg=@vger.kernel.org X-Gm-Message-State: AOJu0YySmQk5aqv0n3rKoqsacsiyqNdmnuenlsoUxOw5gYqPyCB637d+ SXoRQ2MXBTgprqBorGD9ZZIH4INDsUBHgFPTdoGg/nTL74hsH+ZOE9ppzfKtcUJWSa64+w== X-Gm-Gg: AeBDietXlIAORXOuj5V7a7QN7HfqA2cqr7IfCatXc/Sva4OW2Z1TIotOZXlpSZlJHKh 5tUijlw9V2/4NrmIzBTXQ4ZDvxsGQt4Ijh/ZYWb+WWKby+SFVAi8MtbnKE9B2fQdTi7A4XItjee V0FbwRcntpadHX3jjbUqM+nncHEYMu1JQx/tvGXcBVOgwwvl9lyOw+AwzlUXRYf+ZW1Eym7V4Qq lvc0R9hOeKoMM0/lVpKFFwWbCD18MQSHAUJWvcNydcIDm26TUIqrTAfj5hbPFPTi6vJHEWf0f6s f+L7EqrhZjxETJuDteencdtWt7TjNpChxYjdISPqhLUy6snXGfm+0SlFFHdF/aPa7hKH773ySCn x4n9YJGSTtVZWcXlI3Wxvgm0wvVap0yGsm0PuC1DhdM/KXlcfJwBDuoDGhbqjRO04kvHK7SdsgM lqtHl2tXnspPIE4rHMPN/0D9HWCtKyFrQM/loNASl1tfm6JP4rf8fgmqWKblDLihzrbM1s107Wz HUEo2z08pc6ZoSSa3bzqY4= X-Received: by 2002:a17:903:22c6:b0:2ae:3b9b:db34 with SMTP id d9443c01a7336-2b28188da6amr269183375ad.42.1775747267056; Thu, 09 Apr 2026 08:07:47 -0700 (PDT) Received: from SLSGDTSWING002.tail0ac356.ts.net ([129.126.109.177]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b27497af47sm312363305ad.42.2026.04.09.08.07.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 09 Apr 2026 08:07:46 -0700 (PDT) From: Weiming Shi To: Pablo Neira Ayuso , Florian Westphal , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: Phil Sutter , Simon Horman , Patrick McHardy , netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Xiang Mei , Weiming Shi Subject: [PATCH nf] netfilter: nf_conntrack_sip: fix OOB read in epaddr_len and ct_sip_parse_header_uri Date: Thu, 9 Apr 2026 17:50:57 +0800 Message-ID: <20260409095056.706441-2-bestswngs@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In epaddr_len() and ct_sip_parse_header_uri(), after sip_parse_addr() successfully parses an IP address, the code checks whether the next character is ':' to determine if a port number follows. However, neither function verifies that the pointer is still within bounds before dereferencing it. When a SIP header URI contains an IP address that extends to the last byte of the packet data, in4_pton() or in6_pton() consumes all available bytes and returns with the end pointer equal to limit. The subsequent dereference reads one byte past the valid SIP message data. ct_sip_parse_request() already handles this correctly: if (end < limit && *end == ':') { Apply the same bounds check to the two functions that are missing it. Fixes: 9fafcd7b2032 ("[NETFILTER]: nf_conntrack/nf_nat: add SIP helper port") Reported-by: Xiang Mei Signed-off-by: Weiming Shi --- net/netfilter/nf_conntrack_sip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c index 939502ff7c87..83741901c6fb 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -194,7 +194,7 @@ static int epaddr_len(const struct nf_conn *ct, const char *dptr, } /* Port number */ - if (*dptr == ':') { + if (dptr < limit && *dptr == ':') { dptr++; dptr += digits_len(ct, dptr, limit, shift); } @@ -520,7 +520,7 @@ int ct_sip_parse_header_uri(const struct nf_conn *ct, const char *dptr, if (!sip_parse_addr(ct, dptr + *matchoff, &c, addr, limit, true)) return -1; - if (*c == ':') { + if (c < limit && *c == ':') { c++; p = simple_strtoul(c, (char **)&c, 10); if (p < 1024 || p > 65535) -- 2.43.0