[PATCH nf v2] netfilter: nf_conntrack_sip: fix OOB read in ct_sip_parse_transport()

[PATCH nf v2] netfilter: nf_conntrack_sip: fix OOB read in ct_sip_parse_transport()

[Joas Antonio dos Santos]

ct_sip_parse_transport() compares the value of the "transport=" header
parameter against "TCP"/"UDP" with strncasecmp(..., 3), but it never
checks that the parsed value is at least 3 bytes long.

ct_sip_parse_param() returns matchlen = end - start, where end is the
next ';' or, when there is no ';', the end of the payload buffer
(limit = dptr + datalen).  If the "transport=" value is only 1 or 2
bytes long and runs exactly to the end of the payload (e.g. a REGISTER
request whose Contact header ends in ";transport=T" with no trailing
CRLF), matchlen is less than 3 while strncasecmp() still reads up to 3
bytes, reading 1-2 bytes past the end of the linearized skb data.

Add a matchlen check before the comparison, mirroring the
sdp_media_type() pattern a few lines below, so short values cannot reach
strncasecmp().

The bug was found by LLM-assisted manual review of the SIP helper's
parsers and confirmed with a userspace ASan harness built from the
verbatim parser functions, which reports a heap-buffer-overflow read of
size 2 in strncasecmp() called from ct_sip_parse_transport().

Fixes: ea45f12a2766d ("[NETFILTER]: nf_conntrack_sip: parse SIP headers properly")
Link: https://lore.kernel.org/netfilter-devel/20260815133104.50369-1-joasantonio108@gmail.com/
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
Assisted-by: Claude:claude-opus-5-5
---
v2:
- Retarget to nf, rebase on current mainline (no code change).
- Say how the bug was found, add Link: to v1 and Assisted-by:.

v1 (2026-08-15) got no review comments on the list. An equivalent fix
was posted on 2026-10-22 by Duc Anh Luu (Cc'd):
https://lore.kernel.org/netfilter-devel/20261022172248.554687-1-luuducanh05051995@gmail.com/

 net/netfilter/nf_conntrack_sip.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 64bc440b1..b05dc8858 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -701,9 +701,9 @@ static int ct_sip_parse_transport(struct nf_conn *ct, const char *dptr,
 
 	if (ct_sip_parse_param(ct, dptr, dataoff, datalen, "transport=",
 			       &matchoff, &matchlen)) {
-		if (!strncasecmp(dptr + matchoff, "TCP", strlen("TCP")))
+		if (matchlen >= 3 && !strncasecmp(dptr + matchoff, "TCP", 3))
 			*proto = IPPROTO_TCP;
-		else if (!strncasecmp(dptr + matchoff, "UDP", strlen("UDP")))
+		else if (matchlen >= 3 && !strncasecmp(dptr + matchoff, "UDP", 3))
 			*proto = IPPROTO_UDP;
 		else
 			return 0;

Re: [PATCH nf v2] netfilter: nf_conntrack_sip: fix OOB read in ct_sip_parse_transport()

[Fernando Fernandez Mancera]

On 10/24/26 7:03 PM, Joas Antonio dos Santos wrote:
> ct_sip_parse_transport() compares the value of the "transport=" header
> parameter against "TCP"/"UDP" with strncasecmp(..., 3), but it never
> checks that the parsed value is at least 3 bytes long.
> 
> ct_sip_parse_param() returns matchlen = end - start, where end is the
> next ';' or, when there is no ';', the end of the payload buffer
> (limit = dptr + datalen).  If the "transport=" value is only 1 or 2
> bytes long and runs exactly to the end of the payload (e.g. a REGISTER
> request whose Contact header ends in ";transport=T" with no trailing
> CRLF), matchlen is less than 3 while strncasecmp() still reads up to 3
> bytes, reading 1-2 bytes past the end of the linearized skb data.
> 
> Add a matchlen check before the comparison, mirroring the
> sdp_media_type() pattern a few lines below, so short values cannot reach
> strncasecmp().
> 
> The bug was found by LLM-assisted manual review of the SIP helper's
> parsers and confirmed with a userspace ASan harness built from the
> verbatim parser functions, which reports a heap-buffer-overflow read of
> size 2 in strncasecmp() called from ct_sip_parse_transport().
> 
> Fixes: ea45f12a2766d ("[NETFILTER]: nf_conntrack_sip: parse SIP headers properly")
> Link: https://lore.kernel.org/netfilter-devel/20260815133104.50369-1-joasantonio108@gmail.com/
> Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
> Assisted-by: Claude:claude-opus-5-5

Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>

Thanks!