This is a note to let you know that I've just added the patch titled
netfilter: nf_ct_sip: validate Content-Length in TCP SIP messages
to the 2.6.39-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nf_ct_sip-validate-content-length-in-tcp-sip-messages.patch
and it can be found in the queue-2.6.39 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 44e7464f931d31f74815c59520f830fc7ee79fbb Mon Sep 17 00:00:00 2001
From: Patrick McHardy <[email protected]>
Date: Mon, 16 May 2011 14:42:26 +0200
Subject: netfilter: nf_ct_sip: validate Content-Length in TCP SIP messages
From: Patrick McHardy <[email protected]>
[ Upstream commit 274ea0e2a4cdf18110e5931b8ecbfef6353e5293 ]
Verify that the message length of a single SIP message, which is calculated
based on the Content-Length field contained in the SIP message, does not
exceed the packet boundaries.
Signed-off-by: Patrick McHardy <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/netfilter/nf_conntrack_sip.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1461,6 +1461,8 @@ static int sip_help_tcp(struct sk_buff *
end += strlen("\r\n\r\n") + clen;
msglen = origlen = end - dptr;
+ if (msglen > datalen)
+ return NF_DROP;
ret = process_sip_msg(skb, ct, dataoff, &dptr, &msglen);
if (ret != NF_ACCEPT)
Patches currently in stable-queue which might be from [email protected] are
_______________________________________________
stable mailing list
[email protected]
http://linux.kernel.org/mailman/listinfo/stable
