[OpenSIPS-Devel] [OpenSIPS/opensips] 473bf4: identity: validate Identity header copy length

[Răzvan Crainea]

  Branch: refs/heads/3.6
  Home:   https://github.com/OpenSIPS/opensips
  Commit: 473bf476a5e4f82ddaea609fb5de1a0b6089897d
      https://github.com/OpenSIPS/opensips/commit/473bf476a5e4f82ddaea609fb5de1a0b6089897d
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-09-01 (Tue, 01 Sep 2026)

  Changed paths:
    M modules/identity/identity.c

  Log Message:
  -----------
  identity: validate Identity header copy length

References: GHSA-f7wm-6cwv-4q46

Reported-by: Bin Luo (@1121984919) from University of Electronic Science and Technology of China (UESTC)
(cherry picked from commit c599b4d1ed4e3e12486f634a85035b453bf5166b)


  Commit: 474aa1f5cb54e86c538c8451e854efcfd9423f91
      https://github.com/OpenSIPS/opensips/commit/474aa1f5cb54e86c538c8451e854efcfd9423f91
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-09-01 (Tue, 01 Sep 2026)

  Changed paths:
    M modules/proto_hep/hep.c
    M modules/proto_hep/hep.h
    M modules/proto_hep/proto_hep.c
    M modules/sipcapture/sipcapture.c

  Log Message:
  -----------
  proto_hep: free decompressed HEPv3 payloads

When compressed_payload is enabled, unpack_hepv3() replaces
payload_chunk.data with pkg memory returned by decompression, but the
receive path never releases it.

Track ownership of decompressed payload buffers and release them when
the HEP context is freed. Also release owned payloads if a later payload
chunk or sipcapture mutation replaces or deletes the payload.

References: GHSA-3w47-rhcp-gpw5

Reported-by: Bin Luo(@1121984919) from University of Electronic Science and Technology of China (UESTC)
(cherry picked from commit aeae55374428b72069286a75f194eaf11692c0f9)


Compare: https://github.com/OpenSIPS/opensips/compare/a967a1f7b136...474aa1f5cb54

To unsubscribe from these emails, change your notification settings at https://github.com/OpenSIPS/opensips/settings/notifications