SABITHSAHEB left a comment (kamailio/kamailio#4792)
That's on me — the description was from a different fix and didn't match
this change. Fixed now.
Short version: the HEPv3 parser trusts total_length from the header and
walks chunks up to it without checking it against the bytes received. The
HEPv2 path right above already does that check, so HEPv3 was the one missing
it — a malformed packet reads past the buffer, and it's UDP so reachable
remotely. Can paste the ASan trace if useful.
--
Reply to this email directly or view it on GitHub:
https://github.com/kamailio/kamailio/pull/4792#issuecomment-4797426982
You are receiving this because you are subscribed to this thread.
Message ID: <kamailio/kamailio/pull/4792/[email protected]>
_______________________________________________
Kamailio - Development Mailing List -- [email protected]
To unsubscribe send an email to [email protected]
Important: keep the mailing list in the recipients, do not reply only to the
sender!
