Re: [PATCH nf v2] netfilter: nf_conntrack_sip: fix OOB read in ct_sip_parse_transport()

[Fernando Fernandez Mancera]

On 10/24/26 7:03 PM, Joas Antonio dos Santos wrote:
> ct_sip_parse_transport() compares the value of the "transport=" header
> parameter against "TCP"/"UDP" with strncasecmp(..., 3), but it never
> checks that the parsed value is at least 3 bytes long.
>
> ct_sip_parse_param() returns matchlen = end - start, where end is the
> next ';' or, when there is no ';', the end of the payload buffer
> (limit = dptr + datalen).  If the "transport=" value is only 1 or 2
> bytes long and runs exactly to the end of the payload (e.g. a REGISTER
> request whose Contact header ends in ";transport=T" with no trailing
> CRLF), matchlen is less than 3 while strncasecmp() still reads up to 3
> bytes, reading 1-2 bytes past the end of the linearized skb data.
>
> Add a matchlen check before the comparison, mirroring the
> sdp_media_type() pattern a few lines below, so short values cannot reach
> strncasecmp().
>
> The bug was found by LLM-assisted manual review of the SIP helper's
> parsers and confirmed with a userspace ASan harness built from the
> verbatim parser functions, which reports a heap-buffer-overflow read of
> size 2 in strncasecmp() called from ct_sip_parse_transport().
>
> Fixes: ea45f12a2766d ("[NETFILTER]: nf_conntrack_sip: parse SIP headers properly")
> Link: https://lore.kernel.org/netfilter-devel/20260815133104.50369-1-joasantonio108@xxxxxxxxx/
> Signed-off-by: Joas Antonio dos Santos <joasantonio108@xxxxxxxxx>
> Assisted-by: Claude:claude-opus-5-5

Reviewed-by: Fernando Fernandez Mancera <fmancera@xxxxxxx>

Thanks!