Module: kamailio Branch: master Commit: e63eb5b1db0b8ad66db461fc081bf40563aa85eb URL: https://github.com/kamailio/kamailio/commit/e63eb5b1db0b8ad66db461fc081bf40563aa85eb
Author: Daniel-Constantin Mierla <[email protected]> Committer: Daniel-Constantin Mierla <[email protected]> Date: 2026-06-24T09:21:27+02:00 ctl: check for invalid packet size based on int read --- Modified: src/modules/ctl/binrpc.h --- Diff: https://github.com/kamailio/kamailio/commit/e63eb5b1db0b8ad66db461fc081bf40563aa85eb.diff Patch: https://github.com/kamailio/kamailio/commit/e63eb5b1db0b8ad66db461fc081bf40563aa85eb.patch --- diff --git a/src/modules/ctl/binrpc.h b/src/modules/ctl/binrpc.h index aaf621ff29c..9df53b139e3 100644 --- a/src/modules/ctl/binrpc.h +++ b/src/modules/ctl/binrpc.h @@ -629,7 +629,7 @@ static inline int binrpc_check_len( static inline unsigned char *binrpc_parse_init( struct binrpc_parse_ctx *ctx, unsigned char *buf, int len, int *err) { - int len_len, c_len; + int len_len, c_len, t_len; unsigned char *p; *err = 0; @@ -660,14 +660,15 @@ static inline unsigned char *binrpc_parse_init( *err = E_BINRPC_MORE_DATA; goto error; } - p = binrpc_read_int((int *)&ctx->tlen, len_len, &buf[BINRPC_TLEN_OFFSET], - &buf[len], err); + p = binrpc_read_int( + &t_len, len_len, &buf[BINRPC_TLEN_OFFSET], &buf[len], err); if(*err < 0) goto error; - if(ctx->tlen < 0) { + if(t_len < 0) { *err = E_BINRPC_BADPKT; goto error; } + ctx->tlen = t_len; /* empty packets (replies) are allowed if (ctx->tlen==0){ *err=E_BINRPC_BADPKT; _______________________________________________ Kamailio - Development Mailing List -- [email protected] To unsubscribe send an email to [email protected] Important: keep the mailing list in the recipients, do not reply only to the sender!
