In epaddr_len() and ct_sip_parse_header_uri(), after sip_parse_addr() parses an IP address, the pointer (dptr or c) may point at or past limit. The subsequent check for a ':' port separator dereferences the pointer without a bounds check, causing a 1-byte out-of-bounds read. Add bounds checks before the dereference in both locations. Fixes: 05e3ced297fe ("[NETFILTER]: nf_conntrack_sip: introduce SIP-URI parsing helper") Reported-by: Klaudia Kloc Reported-by: Dawid Moczadło Tested-by: Jenny Guanni Qu Signed-off-by: Jenny Guanni Qu --- net/netfilter/nf_conntrack_sip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c index d0eac27f6ba0..a232054d7919 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -194,7 +194,7 @@ static int epaddr_len(const struct nf_conn *ct, const char *dptr, } /* Port number */ - if (*dptr == ':') { + if (dptr < limit && *dptr == ':') { dptr++; dptr += digits_len(ct, dptr, limit, shift); } @@ -520,7 +520,7 @@ int ct_sip_parse_header_uri(const struct nf_conn *ct, const char *dptr, if (!sip_parse_addr(ct, dptr + *matchoff, &c, addr, limit, true)) return -1; - if (*c == ':') { + if (c < limit && *c == ':') { c++; p = simple_strtoul(c, (char **)&c, 10); if (p < 1024 || p > 65535) -- 2.34.1