From c1c9c9cf9a6f0554a20ccb0a9fbbfb5f5777644b Mon Sep 17 00:00:00 2001
From: Donat Zenichev <dzenichev@sipwise.com>
Date: Tue, 3 Mar 2026 09:41:27 +0100
Subject: [PATCH] MT#64562 core: tcp read - checks for MSRP first line

Upstream backport of a major security fix.

Change-Id: I63152fc3c61700928161b2e06dc6b8e219dcc5f1
(cherry picked from commit e522c58368b17522144246dd96242c119f210d2c)
---
 debian/patches/series                         |  1 +
 ...e_tcp_read_check_for_first_msrp_line.patch | 36 +++++++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 debian/patches/upstream/core_tcp_read_check_for_first_msrp_line.patch

diff --git a/debian/patches/series b/debian/patches/series
index b3607366e..aeea45be9 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -32,6 +32,7 @@ sipwise/sca-debug.patch
 sipwise/sca-fix-notify-after-bye.patch
 sipwise/sca-add-pai_avp-parameter.patch
 ## upstream 5.7
+upstream/core_tcp_read_check_for_first_msrp_line.patch
 #
 ## upstream master
 sipwise/pv_headers-rework-pvh_remove_header_param-take-two.patch
diff --git a/debian/patches/upstream/core_tcp_read_check_for_first_msrp_line.patch b/debian/patches/upstream/core_tcp_read_check_for_first_msrp_line.patch
new file mode 100644
index 000000000..b4214d2f0
--- /dev/null
+++ b/debian/patches/upstream/core_tcp_read_check_for_first_msrp_line.patch
@@ -0,0 +1,36 @@
+--- a/src/core/tcp_read.c
++++ b/src/core/tcp_read.c
+@@ -1035,11 +1035,31 @@ int tcp_read_headers(struct tcp_connecti
+ 					/* locate transaction id in first line
+ 					 * -- first line exists, that's why we are here */
+ 					mfline = q_memchr(r->start, '\n', r->pos - r->start);
+-					mtransid.s = q_memchr(
+-							r->start + 5 /* 'MSRP ' */, ' ', mfline - r->start);
++					if(mfline == NULL || mfline - r->start < 8) {
++						r->error = TCP_READ_ERROR;
++						r->state = H_SKIP; /* skip now */
++						goto skip;
++					}
++					mtransid.s = q_memchr(r->start + 5 /* 'MSRP ' */, ' ',
++							mfline - r->start - 5);
++					if(mtransid.s == NULL) {
++						r->error = TCP_READ_ERROR;
++						r->state = H_SKIP; /* skip now */
++						goto skip;
++					}
+ 					mtransid.len = mtransid.s - r->start - 5;
++					if(mtransid.len <= 0) {
++						r->error = TCP_READ_ERROR;
++						r->state = H_SKIP; /* skip now */
++						goto skip;
++					}
+ 					mtransid.s = r->start + 5;
+ 					trim(&mtransid);
++					if(mtransid.len <= 0) {
++						r->error = TCP_READ_ERROR;
++						r->state = H_SKIP; /* skip now */
++						goto skip;
++					}
+ 					if(memcmp(mtransid.s,
+ 							   p - 1 /*\r*/ - 1 /* '+'|'#'|'$' */
+ 									   - mtransid.len,