Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package sngrep for openSUSE:Factory checked in at 2026-09-15 12:49:12 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/sngrep (Old) and /work/SRC/openSUSE:Factory/.sngrep.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "sngrep" Tue Sep 15 12:49:12 2026 rev:17 rq:1377995 version:1.8.4 Changes: -------- --- /work/SRC/openSUSE:Factory/sngrep/sngrep.changes 2026-07-26 11:32:20.326701289 +0200 +++ /work/SRC/openSUSE:Factory/.sngrep.new.383539/sngrep.changes 2026-09-15 12:49:20.857251886 +0200 @@ -1,0 +2,8 @@ +Mon Sep 14 15:34:24 UTC 2026 - Martin Hauke <[email protected]> + +- CVE-2026-90558: stack buffer overflow in SIP attribute formatting + routines when header values exceed the 255-byte buffer limit. + Add 0001-fix-prevent-stack-buffer-overflow-in-SIP-attribute-f.patch + (boo#1280297). + +------------------------------------------------------------------- New: ---- 0001-fix-prevent-stack-buffer-overflow-in-SIP-attribute-f.patch ----------(New B)---------- New: routines when header values exceed the 255-byte buffer limit. Add 0001-fix-prevent-stack-buffer-overflow-in-SIP-attribute-f.patch (boo#1280297). ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ sngrep.spec ++++++ --- /var/tmp/diff_new_pack.KkCBtE/_old 2026-09-15 12:49:21.697286905 +0200 +++ /var/tmp/diff_new_pack.KkCBtE/_new 2026-09-15 12:49:21.699286988 +0200 @@ -27,6 +27,7 @@ URL: https://github.com/irontec/sngrep #Git-Clone: https://github.com/irontec/sngrep.git Source: https://github.com/irontec/%{name}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz +Patch0: 0001-fix-prevent-stack-buffer-overflow-in-SIP-attribute-f.patch BuildRequires: autoconf BuildRequires: automake BuildRequires: libpcap-devel ++++++ 0001-fix-prevent-stack-buffer-overflow-in-SIP-attribute-f.patch ++++++ >From 1ff74ee3ab5ff280e8ba976aa8c744dca57eb35b Mon Sep 17 00:00:00 2001 From: Kaian <[email protected]> Date: Fri, 7 Aug 2026 08:45:42 +0200 Subject: [PATCH] fix: prevent stack buffer overflow in SIP attribute formatting call_get_attribute() formatted the Call-ID, X-Call-ID and Reason header text with an unbounded sprintf("%s"). Call-ID/X-Call-ID can hold up to MAX_CALLID_SIZE/MAX_XCALLID_SIZE (1023 bytes) and Reason text is copied from the raw payload (up to MAX_SIP_PAYLOAD), while all callers pass a 255-byte SIP_ATTR_MAXLEN stack buffer (call list rendering, sort compare). A SIP message with a long Call-ID, X-Call-ID or Reason header overflowed the stack, triggerable via pcap, live capture or HEP/EEP remote capture. Bound these writes with "%.*s" and SIP_ATTR_MAXLEN - 1. Also fix a matching off-by-one in msg_get_attribute(), where the existing "%.*s" used SIP_ATTR_MAXLEN as the precision and could write 256 bytes (255 chars + NUL) into the 255-byte buffer. Thanks to TristanInSec for reporting the issue. --- src/sip_call.c | 6 +++--- src/sip_msg.c | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/sip_call.c b/src/sip_call.c index 73558ca..a23a156 100644 --- a/src/sip_call.c +++ b/src/sip_call.c @@ -257,10 +257,10 @@ call_get_attribute(sip_call_t *call, enum sip_attr_id id, char *value) sprintf(value, "%d", call->index); break; case SIP_ATTR_CALLID: - sprintf(value, "%s", call->callid); + sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->callid); break; case SIP_ATTR_XCALLID: - sprintf(value, "%s", call->xcallid); + sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->xcallid); break; case SIP_ATTR_MSGCNT: sprintf(value, "%d", vector_count(call->msgs)); @@ -282,7 +282,7 @@ call_get_attribute(sip_call_t *call, enum sip_attr_id id, char *value) break; case SIP_ATTR_REASON_TXT: if (call->reasontxt) - sprintf(value, "%s", call->reasontxt); + sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->reasontxt); break; case SIP_ATTR_WARNING: if (call->warning) diff --git a/src/sip_msg.c b/src/sip_msg.c index b932910..f4d1951 100644 --- a/src/sip_msg.c +++ b/src/sip_msg.c @@ -137,13 +137,13 @@ msg_get_attribute(sip_msg_t *msg, int id, char *value) } break; case SIP_ATTR_METHOD: - sprintf(value, "%.*s", SIP_ATTR_MAXLEN, sip_get_msg_reqresp_str(msg)); + sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, sip_get_msg_reqresp_str(msg)); break; case SIP_ATTR_SIPFROM: - sprintf(value, "%.*s", SIP_ATTR_MAXLEN, msg->sip_from); + sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, msg->sip_from); break; case SIP_ATTR_SIPTO: - sprintf(value, "%.*s", SIP_ATTR_MAXLEN, msg->sip_to); + sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, msg->sip_to); break; case SIP_ATTR_SIPFROMUSER: if (msg->sip_from && (ar = strchr(msg->sip_from, '@'))) { @@ -163,7 +163,7 @@ msg_get_attribute(sip_msg_t *msg, int id, char *value) break; case SIP_ATTR_CONTACT: if (msg->sip_contact) { - sprintf(value, "%.*s", SIP_ATTR_MAXLEN, msg->sip_contact); + sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, msg->sip_contact); } break; default: -- 2.55.0
