[OpenSIPS-Devel] [OpenSIPS/opensips] c47d47: sngtc: validate SDP connection IP length

[Răzvan Crainea]

  Branch: refs/heads/3.6
  Home:   https://github.com/OpenSIPS/opensips
  Commit: c47d47da73f7146131c13a85d5ea6b7f2cbe621b
      https://github.com/OpenSIPS/opensips/commit/c47d47da73f7146131c13a85d5ea6b7f2cbe621b
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-08-24 (Mon, 24 Aug 2026)

  Changed paths:
    M modules/sngtc/sngtc.c

  Log Message:
  -----------
  sngtc: validate SDP connection IP length

Reject SDP connection address tokens that cannot fit in the IPv4 conversion buffer before copying them for inet_pton(). This keeps transcoding session setup from writing past the stack buffer while parsing untrusted SDP.

Addresses GHSA-6pjc-3x9r-mp8h.

Reported by zx (Jace, @manus-use).

(cherry picked from commit 87ec59696a6f606f468093f472d9b77762cda800)



To unsubscribe from these emails, change your notification settings at https://github.com/OpenSIPS/opensips/settings/notifications