[OpenSIPS-Devel] [OpenSIPS/opensips] 5ba06b: identity: validate Identity header copy length

[Răzvan Crainea]

  Branch: refs/heads/4.0
  Home:   https://github.com/OpenSIPS/opensips
  Commit: 5ba06bf2e70f934cb420dc39827960897de5a973
      https://github.com/OpenSIPS/opensips/commit/5ba06bf2e70f934cb420dc39827960897de5a973
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-09-01 (Tue, 01 Sep 2026)

  Changed paths:
    M modules/identity/identity.c

  Log Message:
  -----------
  identity: validate Identity header copy length

References: GHSA-f7wm-6cwv-4q46

Reported-by: Bin Luo (@1121984919) from University of Electronic Science and Technology of China (UESTC)
(cherry picked from commit c599b4d1ed4e3e12486f634a85035b453bf5166b)


  Commit: aff1540e1a2aae27bf1ad7904a1a7886838e3bdc
      https://github.com/OpenSIPS/opensips/commit/aff1540e1a2aae27bf1ad7904a1a7886838e3bdc
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-09-01 (Tue, 01 Sep 2026)

  Changed paths:
    M modules/proto_hep/hep.c
    M modules/proto_hep/hep.h
    M modules/proto_hep/proto_hep.c
    M modules/sipcapture/sipcapture.c

  Log Message:
  -----------
  proto_hep: free decompressed HEPv3 payloads

When compressed_payload is enabled, unpack_hepv3() replaces
payload_chunk.data with pkg memory returned by decompression, but the
receive path never releases it.

Track ownership of decompressed payload buffers and release them when
the HEP context is freed. Also release owned payloads if a later payload
chunk or sipcapture mutation replaces or deletes the payload.

References: GHSA-3w47-rhcp-gpw5

Reported-by: Bin Luo(@1121984919) from University of Electronic Science and Technology of China (UESTC)
(cherry picked from commit aeae55374428b72069286a75f194eaf11692c0f9)


Compare: https://github.com/OpenSIPS/opensips/compare/0fc94bfa695e...aff1540e1a2a

To unsubscribe from these emails, change your notification settings at https://github.com/OpenSIPS/opensips/settings/notifications