[OpenSIPS-Devel] [OpenSIPS/opensips] cef86c: sngtc: validate SDP connection IP length

[Răzvan Crainea]

  Branch: refs/heads/4.0
  Home:   https://github.com/OpenSIPS/opensips
  Commit: cef86c4c8b564547224ec6321597fc2b162a02a8
      https://github.com/OpenSIPS/opensips/commit/cef86c4c8b564547224ec6321597fc2b162a02a8
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-08-24 (Mon, 24 Aug 2026)

  Changed paths:
    M modules/sngtc/sngtc.c

  Log Message:
  -----------
  sngtc: validate SDP connection IP length

Reject SDP connection address tokens that cannot fit in the IPv4 conversion buffer before copying them for inet_pton(). This keeps transcoding session setup from writing past the stack buffer while parsing untrusted SDP.

Addresses GHSA-6pjc-3x9r-mp8h.

Reported by zx (Jace, @manus-use).

(cherry picked from commit 87ec59696a6f606f468093f472d9b77762cda800)



To unsubscribe from these emails, change your notification settings at https://github.com/OpenSIPS/opensips/settings/notifications