Re: [PATCH nf v2] netfilter: nf_conntrack_sip: fix OOB read in ct_sip_parse_transport()

[Fernando Fernandez Mancera <fmancera@suse.de>]

On 10/24/26 7:03 PM, Joas Antonio dos Santos wrote:
> ct_sip_parse_transport() compares the value of the "transport=" header
> parameter against "TCP"/"UDP" with strncasecmp(..., 3), but it never
> checks that the parsed value is at least 3 bytes long.
> 
> ct_sip_parse_param() returns matchlen = end - start, where end is the
> next ';' or, when there is no ';', the end of the payload buffer
> (limit = dptr + datalen).  If the "transport=" value is only 1 or 2
> bytes long and runs exactly to the end of the payload (e.g. a REGISTER
> request whose Contact header ends in ";transport=T" with no trailing
> CRLF), matchlen is less than 3 while strncasecmp() still reads up to 3
> bytes, reading 1-2 bytes past the end of the linearized skb data.
> 
> Add a matchlen check before the comparison, mirroring the
> sdp_media_type() pattern a few lines below, so short values cannot reach
> strncasecmp().
> 
> The bug was found by LLM-assisted manual review of the SIP helper's
> parsers and confirmed with a userspace ASan harness built from the
> verbatim parser functions, which reports a heap-buffer-overflow read of
> size 2 in strncasecmp() called from ct_sip_parse_transport().
> 
> Fixes: ea45f12a2766d ("[NETFILTER]: nf_conntrack_sip: parse SIP headers properly")
> Link: https://lore.kernel.org/netfilter-devel/20260815133104.50369-1-joasantonio108@gmail.com/
> Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
> Assisted-by: Claude:claude-opus-5-5

Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>

Thanks!