[OpenSIPS-Devel] [OpenSIPS/opensips] 834c79: net_tcp: reject NULL message buffer with non-zero ...

[Răzvan Crainea]

  Branch: refs/heads/master
  Home:   https://github.com/OpenSIPS/opensips
  Commit: 834c791c6c30ab3623dda1900897e658648239f7
      https://github.com/OpenSIPS/opensips/commit/834c791c6c30ab3623dda1900897e658648239f7
  Author: Giovanni Maruzzelli <gmaruzz at opentelecom.it>
  Date:   2026-08-18 (Tue, 18 Aug 2026)

  Changed paths:
    M net/net_tcp.c

  Log Message:
  -----------
  net_tcp: reject NULL message buffer with non-zero length in tcp_dispatch_msg()

tcp_dispatch_msg() already guards against a negative len, a negative
data_len, and a missing data buffer for a non-zero data_len -- but not
against a NULL msg with a non-zero len, which reaches memcpy(payload->
msg_buf, msg, len) unchecked a few lines below and crashes.

Observed live: proto_ws's ws_process() (WS_OP_TEXT/WS_OP_BIN case) called
tcp_dispatch_msg(msg_buf, msg_len, &local_rcv, NULL, 0) with msg_buf ==
NULL (req->tcp.body) and msg_len == a large garbage value, causing a
SIGSEGV in memcpy. gdb confirmed the exact parameter values at the crash
site: msg=0x0, len=872728144. The path that got req->tcp.body into that
state was not conclusively reproduced (no packet capture survived long
enough to inspect the triggering frame), but regardless of which caller
or which malformed input produces it, a NULL buffer with a non-zero
length should never reach this memcpy -- the same defensive posture the
function already takes for the other three parameters.

This is a minimal, caller-agnostic guard: any future caller with a
similar bug fails safe (LM_BUG + return -1) instead of crashing the
whole process.


  Commit: 4e8972dda429b7029f411a0e48a0d04226e36a18
      https://github.com/OpenSIPS/opensips/commit/4e8972dda429b7029f411a0e48a0d04226e36a18
  Author: Răzvan Crainea <razvan at opensips.org>
  Date:   2026-08-19 (Wed, 19 Aug 2026)

  Changed paths:
    M net/net_tcp.c

  Log Message:
  -----------
  Merge pull request #4218 from gmaruzz/fix/tcp-dispatch-msg-null-msg-check

net_tcp: reject NULL message buffer with non-zero length in tcp_dispatch_msg()


Compare: https://github.com/OpenSIPS/opensips/compare/4f65354b05d1...4e8972dda429

To unsubscribe from these emails, change your notification settings at https://github.com/OpenSIPS/opensips/settings/notifications