Skip to content

sip: Parser.Parse allocates the declared Content-Length before rejecting the message #342

Description

@Mliviu79

On the datagram path Parser.Parse(data, false) takes the declared Content-Length into make([]byte, bodySize) guarded only by if bodySize < 0. The entry check bounds the bytes that arrived, not the body that was declared.

Measured on main (3f46033), default ParseMaxMessageLength = 65,535, a body-less INVITE declaring Content-Length: 4294967295:

datagram on the wire   229 bytes
heap allocated         4,294,974,824 bytes
body attached          4,294,967,295 bytes
returned error         reading body incomplete

The message is rejected, but only after the allocation. UDP and WebSocket both reach this through ParseSIP -> Parse(data, false).

Fix: bound the declared body against what is left of the message budget, before the make.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions