From f51b3ff03cfbf3b1dfd0a193f3cc262dd203db69 Mon Sep 17 00:00:00 2001 From: Richard Fuchs Date: Mon, 26 Oct 2026 07:21:05 -0400 Subject: [PATCH] MT#55283 check skb->len against UDP header Change-Id: Idda845297199fcd70f06bc375eeb30a362ee2a68 (cherry picked from commit ca0b2f76e64b6a3615b45b92273907eedf63f7d1) (cherry picked from commit 35c971a20eaf77fdb4a3a6bd004458d84e7b6853) --- kernel-module/nft_rtpengine.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel-module/nft_rtpengine.c b/kernel-module/nft_rtpengine.c index 5c6972a4d..821d8def8 100644 --- a/kernel-module/nft_rtpengine.c +++ b/kernel-module/nft_rtpengine.c @@ -7154,7 +7154,7 @@ static int rtpengine46(struct sk_buff *oskb, g->decrypt_rtp.cipher->name); datalen = ntohs(uh->len); - if (datalen < sizeof(*uh)) + if (datalen < sizeof(*uh) || datalen > oskb->len - (oskb->transport_header - oskb->network_header)) goto out_target; datalen -= sizeof(*uh); DBG("udp payload = %u\n", datalen);