[OpenSIPS-Devel] [OpenSIPS/opensips] c599b4: identity: validate Identity header copy length

[Răzvan Crainea]

  Branch: refs/heads/master
  Home:   https://github.com/OpenSIPS/opensips
  Commit: c599b4d1ed4e3e12486f634a85035b453bf5166b
      https://github.com/OpenSIPS/opensips/commit/c599b4d1ed4e3e12486f634a85035b453bf5166b
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-07-20 (Mon, 20 Jul 2026)

  Changed paths:
    M modules/identity/identity.c

  Log Message:
  -----------
  identity: validate Identity header copy length

References: GHSA-f7wm-6cwv-4q46

Reported-by: Bin Luo (@1121984919) from University of Electronic Science and Technology of China (UESTC)


  Commit: aeae55374428b72069286a75f194eaf11692c0f9
      https://github.com/OpenSIPS/opensips/commit/aeae55374428b72069286a75f194eaf11692c0f9
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-07-20 (Mon, 20 Jul 2026)

  Changed paths:
    M modules/proto_hep/hep.c
    M modules/proto_hep/hep.h
    M modules/proto_hep/proto_hep.c
    M modules/sipcapture/sipcapture.c

  Log Message:
  -----------
  proto_hep: free decompressed HEPv3 payloads

When compressed_payload is enabled, unpack_hepv3() replaces
payload_chunk.data with pkg memory returned by decompression, but the
receive path never releases it.

Track ownership of decompressed payload buffers and release them when
the HEP context is freed. Also release owned payloads if a later payload
chunk or sipcapture mutation replaces or deletes the payload.

References: GHSA-3w47-rhcp-gpw5

Reported-by: Bin Luo(@1121984919) from University of Electronic Science and Technology of China (UESTC)


Compare: https://github.com/OpenSIPS/opensips/compare/e670eed25052...aeae55374428

To unsubscribe from these emails, change your notification settings at https://github.com/OpenSIPS/opensips/settings/notifications