Module: kamailio Branch: master Commit: 2c47fe1625b57e04252230e0e783ba4182afbebb URL: https://github.com/kamailio/kamailio/commit/2c47fe1625b57e04252230e0e783ba4182afbebb
Author: Daniel-Constantin Mierla <[email protected]> Committer: Daniel-Constantin Mierla <[email protected]> Date: 2026-03-01T22:56:09+01:00 core: tcp read - check coontent lenght for max int limit --- Modified: src/core/tcp_read.c --- Diff: https://github.com/kamailio/kamailio/commit/2c47fe1625b57e04252230e0e783ba4182afbebb.diff Patch: https://github.com/kamailio/kamailio/commit/2c47fe1625b57e04252230e0e783ba4182afbebb.patch --- diff --git a/src/core/tcp_read.c b/src/core/tcp_read.c index 334743054d4..211571cf1c4 100644 --- a/src/core/tcp_read.c +++ b/src/core/tcp_read.c @@ -950,7 +950,16 @@ int tcp_read_headers(struct tcp_connection *c, rd_conn_flags_t *read_flags) case '7': case '8': case '9': - r->content_len = r->content_len * 10 + (*p - '0'); + if(r->content_len >= INT_MAX / 10) { + LM_ERR("large Content-Length header value %d in" + " state %d\n", + r->content_len, r->state); + r->content_len = 0; + r->error = TCP_REQ_BAD_LEN; + r->state = H_SKIP; /* skip now */ + } else { + r->content_len = r->content_len * 10 + (*p - '0'); + } break; case '\r': case ' ': _______________________________________________ Kamailio - Development Mailing List -- [email protected] To unsubscribe send an email to [email protected] Important: keep the mailing list in the recipients, do not reply only to the sender!
