Module: kamailio
Branch: master
Commit: 976f4ef1bd9b603a6a8e115c05f827a3796ddcf0
URL: 
https://github.com/kamailio/kamailio/commit/976f4ef1bd9b603a6a8e115c05f827a3796ddcf0

Author: Daniel-Constantin Mierla <[email protected]>
Committer: Daniel-Constantin Mierla <[email protected]>
Date: 2026-06-24T10:43:29+02:00

core: parser - check length for read on parse option tags

---

Modified: src/core/parser/parse_option_tags.h

---

Diff:  
https://github.com/kamailio/kamailio/commit/976f4ef1bd9b603a6a8e115c05f827a3796ddcf0.diff
Patch: 
https://github.com/kamailio/kamailio/commit/976f4ef1bd9b603a6a8e115c05f827a3796ddcf0.patch

---

diff --git a/src/core/parser/parse_option_tags.h 
b/src/core/parser/parse_option_tags.h
index bfc444e331f..573560fac32 100644
--- a/src/core/parser/parse_option_tags.h
+++ b/src/core/parser/parse_option_tags.h
@@ -98,41 +98,46 @@ static inline int parse_option_tag_body(str *body, unsigned 
int *tags)
                for(; pos < len && IS_DELIM(p); ++pos, ++p)
                        ;
 
-               val = LOWER_DWORD(READ(p));
                case_found = 0;
-               switch(val) {
-
-                       /* "path" */
-                       case _path_:
-                               if(pos + 4 <= len && IS_DELIM(p + 4)) {
-                                       *tags |= F_OPTION_TAG_PATH;
-                                       pos += 5;
-                                       p += 5;
-                                       case_found = 1;
-                               }
-                               break;
-
-                       /* "100rel" */
-                       case _100r_:
-                               if(pos + 6 <= len && LOWER_BYTE(*(p + 4)) == 'e'
-                                               && LOWER_BYTE(*(p + 5)) == 'l' 
&& IS_DELIM(p + 6)) {
-                                       *tags |= F_OPTION_TAG_100REL;
-                                       pos += OPTION_TAG_100REL_LEN + 1;
-                                       p += OPTION_TAG_100REL_LEN + 1;
-                                       case_found = 1;
-                               }
-                               break;
-
-                       /* "timer" */
-                       case _time_:
-                               if(pos + 5 <= len && LOWER_BYTE(*(p + 4)) == 'r'
-                                               && IS_DELIM(p + 5)) {
-                                       *tags |= F_OPTION_TAG_TIMER;
-                                       pos += OPTION_TAG_TIMER_LEN + 1;
-                                       p += OPTION_TAG_TIMER_LEN + 1;
-                                       case_found = 1;
-                               }
-                               break;
+               if(pos >= len) {
+                       break;
+               }
+               if(len - pos >= 4) {
+                       val = LOWER_DWORD(READ(p));
+                       switch(val) {
+
+                               /* "path" */
+                               case _path_:
+                                       if(pos + 4 <= len && IS_DELIM(p + 4)) {
+                                               *tags |= F_OPTION_TAG_PATH;
+                                               pos += 5;
+                                               p += 5;
+                                               case_found = 1;
+                                       }
+                                       break;
+
+                               /* "100rel" */
+                               case _100r_:
+                                       if(pos + 6 <= len && LOWER_BYTE(*(p + 
4)) == 'e'
+                                                       && LOWER_BYTE(*(p + 5)) 
== 'l' && IS_DELIM(p + 6)) {
+                                               *tags |= F_OPTION_TAG_100REL;
+                                               pos += OPTION_TAG_100REL_LEN + 
1;
+                                               p += OPTION_TAG_100REL_LEN + 1;
+                                               case_found = 1;
+                                       }
+                                       break;
+
+                               /* "timer" */
+                               case _time_:
+                                       if(pos + 5 <= len && LOWER_BYTE(*(p + 
4)) == 'r'
+                                                       && IS_DELIM(p + 5)) {
+                                               *tags |= F_OPTION_TAG_TIMER;
+                                               pos += OPTION_TAG_TIMER_LEN + 1;
+                                               p += OPTION_TAG_TIMER_LEN + 1;
+                                               case_found = 1;
+                                       }
+                                       break;
+                       }
                }
                if(case_found == 0) {
                        /* extra require or unknown */

_______________________________________________
Kamailio - Development Mailing List -- [email protected]
To unsubscribe send an email to [email protected]
Important: keep the mailing list in the recipients, do not reply only to the 
sender!

Reply via email to