Module: kamailio Branch: master Commit: 2885392b291d5de8e517500aaaa30edd0d27003d URL: https://github.com/kamailio/kamailio/commit/2885392b291d5de8e517500aaaa30edd0d27003d
Author: Daniel-Constantin Mierla <[email protected]> Committer: Daniel-Constantin Mierla <[email protected]> Date: 2026-05-03T09:49:40+02:00 tmx: checks of sizes for attributes matching pre-tran - test uas request for replying on callid --- Modified: src/modules/tmx/tmx_mod.c Modified: src/modules/tmx/tmx_pretran.c --- Diff: https://github.com/kamailio/kamailio/commit/2885392b291d5de8e517500aaaa30edd0d27003d.diff Patch: https://github.com/kamailio/kamailio/commit/2885392b291d5de8e517500aaaa30edd0d27003d.patch --- diff --git a/src/modules/tmx/tmx_mod.c b/src/modules/tmx/tmx_mod.c index ea17e1539f5..0917389352c 100644 --- a/src/modules/tmx/tmx_mod.c +++ b/src/modules/tmx/tmx_mod.c @@ -613,6 +613,10 @@ static int ki_t_reply_callid( } LM_DBG("now calling internal tm reply\n"); + if(trans->uas.request == NULL) { + LM_DBG("no uas.request for transaction\n"); + return -1; + } if(_tmx_tmb.t_reply_trans( trans, trans->uas.request, (unsigned int)code, status_s->s) > 0) diff --git a/src/modules/tmx/tmx_pretran.c b/src/modules/tmx/tmx_pretran.c index 7e1ba9d49c5..332d82dd825 100644 --- a/src/modules/tmx/tmx_pretran.c +++ b/src/modules/tmx/tmx_pretran.c @@ -252,6 +252,12 @@ int tmx_check_pretran(sip_msg_t *msg) sftag = get_from(msg)->tag_value; trim(&sftag); + if(4096 < scallid.len || 32 < scseqnum.len || 128 < scseqmet.len + || 4096 < sftag.len) { + LM_ERR("attributes are too large\n"); + return -1; + } + chid = get_hash1_raw(scallid.s, scallid.len); slotid = chid & (_tmx_ptran_size - 1); @@ -265,9 +271,14 @@ int tmx_check_pretran(sip_msg_t *msg) _tmx_proc_ptran->pid = my_pid(); } dsize = scallid.len + scseqnum.len + scseqmet.len + sftag.len + 4; + if(likely(vbr != NULL)) { svbranch = vbr->value; trim(&svbranch); + if(4096 < svbranch.len + 1) { + LM_ERR("too large branch value\n"); + return -1; + } dsize += svbranch.len + 1; } if(dsize < 256) _______________________________________________ Kamailio - Development Mailing List -- [email protected] To unsubscribe send an email to [email protected] Important: keep the mailing list in the recipients, do not reply only to the sender!
