Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5D2DE4E534E; Thu, 17 Sep 2026 17:19:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789665576; cv=none; b=V/oMMXeFbQkmvCRXuJPgmFATNyqEhb+Qlwsq3d6Wkerx/T34wQITQPDLwAlmqqocucwR0lRW8jJX7LqWGSDOEmLnTTcGN9Y1O0xapLh1ZN5g44sI92WKlUJ4I1kroaDDJOKNw/M8791PS6ePnke64EDV5S3V9J6Box+cl2kxDnI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789665576; c=relaxed/simple; bh=ifRfQ/x3iecgfJP4kzvFrUE2AMcCItSRHoOPNYx9TQ4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=CbrCzXnB5rgJstlQksFvX3LDcTN3RpnLW/u/uhZTlCcX82eo/bU9iy9EK1KS2pr7B3F8sPn2jzHZRnEVzhp/lzMY5JjQDIdcevAt4iqynnAk4T8JglFnVskyiCzb8ku+64l0BtyzCSP11VUeTCEqL8Oqn9/rptp7fsLUKN3/Nuc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=s/b51jhc; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="s/b51jhc" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97E541F000FF; Thu, 17 Sep 2026 17:19:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789665575; bh=W5OsaoL9u+EAGshWXFMCwFh8sFM++095RCpzSsjqhLY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=s/b51jhcClJ12pdJTziX+l8g5X9tWYnP/rR4TyR8y+pWNI1iOpRmoaJX806Bw4siA E34PWK3fsYd5sAQB8SRrku2cs7Di6K6nav39AYJsgIxioXAzoisXTMtU3TFCcmQKNF /WFhv/OGAGMdoWaTydpAP9zbJ+tVLkBbI1bboDtg= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Joas Antonio dos Santos , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 6.18 0733/1250] netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() Date: Thu, 17 Sep 2026 16:08:48 +0100 Message-ID: <20260917151611.757906499@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260917151551.901433442@linuxfoundation.org> References: <20260917151551.901433442@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joas Antonio dos Santos [ Upstream commit e8f8231824b5815f57ce62cba116e511b10196de ] sip_skip_whitespace() returns dptr unchanged when its own loop exhausts the buffer (dptr == limit), instead of NULL like its sibling sip_follow_continuation() returns on its own "no more data" path. ct_sip_get_header() only checks for NULL after calling it: dptr = sip_skip_whitespace(dptr, limit); if (dptr == NULL) break; if (*dptr != ':' || ++dptr >= limit) break; so a recognized header name followed only by spaces/tabs running to the exact end of the SIP payload, with no colon, makes the very next statement read one byte past the buffer. Make both "no more data" outcomes return NULL, matching the convention sip_follow_continuation() already uses and that both existing callers already check for. Fixes: ea45f12a2766d ("[NETFILTER]: nf_conntrack_sip: parse SIP headers properly") Signed-off-by: Joas Antonio dos Santos Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/netfilter/nf_conntrack_sip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c index f5f9bd47d2889..5b75e9bc99e9f 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -429,7 +429,7 @@ static const char *sip_skip_whitespace(const char *dptr, const char *limit) dptr = sip_follow_continuation(dptr, limit); break; } - return dptr; + return dptr < limit ? dptr : NULL; } /* Search within a SIP header value, dealing with continuation lines */ -- 2.53.0