Version in base suite: 6.0.1-1+deb13u1 Base version: kamailio_6.0.1-1+deb13u1 Target version: kamailio_6.0.1-1+deb13u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/k/kamailio/kamailio_6.0.1-1+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/k/kamailio/kamailio_6.0.1-1+deb13u2.dsc changelog | 10 patches/series | 29 ++ patches/upstream/auth-add-defines-for-authenticate-flags.patch | 71 +++++ patches/upstream/auth-init-variable.patch | 22 + patches/upstream/auth-propagate-auth-header-via-pv_authenticate.patch | 126 ++++++++++ patches/upstream/auth-use-AUTH_FLAG_NOINVNC-flag.patch | 22 + patches/upstream/auth_db-init-variable-and-set-the-result-header-late.patch | 41 +++ patches/upstream/core-tcp-read-check-coontent-lenght-for-max-int-limi.patch | 32 ++ patches/upstream/ims_auth-check-len-before-get_4bytes.patch | 69 +++++ patches/upstream/ims_charging-check-len-before-get_4bytes.patch | 86 ++++++ patches/upstream/ims_icscf-check-len-before-get_4bytes.patch | 69 +++++ patches/upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free-ta.patch | 26 ++ patches/upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free-ta3.patch | 27 ++ patches/upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free.patch | 49 +++ patches/upstream/ims_ipsec_pcscf-free-previous-sec-agree-value-at-pro.patch | 34 ++ patches/upstream/ims_ocs-Free-after-copying-the-values.patch | 26 ++ patches/upstream/ims_ocs-check-len-before-get_4bytes.patch | 95 +++++++ patches/upstream/ims_qos-check-len-before-get_4bytes.patch | 50 +++ patches/upstream/ims_qos_npn-check-len-before-get_4bytes.patch | 50 +++ patches/upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre.patch | 49 +++ patches/upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre2.patch | 30 ++ patches/upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre3.patch | 27 ++ patches/upstream/ims_registrar_pcscf-free-previous-sec-agree-value-at.patch | 34 ++ patches/upstream/ims_registrar_scscf-check-len-before-get_4bytes.patch | 69 +++++ 24 files changed, 1142 insertions(+), 1 deletion(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp3e9_r8n7/kamailio_6.0.1-1+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp3e9_r8n7/kamailio_6.0.1-1+deb13u2.dsc: no acceptable signature found diff -Nru kamailio-6.0.1/debian/changelog kamailio-6.0.1/debian/changelog --- kamailio-6.0.1/debian/changelog 2025-08-28 10:54:46.000000000 +0000 +++ kamailio-6.0.1/debian/changelog 2026-09-08 21:48:12.000000000 +0000 @@ -1,3 +1,13 @@ +kamailio (6.0.1-1+deb13u2) trixie-security; urgency=medium + + * CVE-2026-39863 fix + * CVE-2026-39864 fix + * CVE-2026-52022 fix + * CVE-2026-52023 fix + * CVE-2026-82608 fix + + -- Victor Seva Tue, 08 Sep 2026 23:48:12 +0200 + kamailio (6.0.1-1+deb13u1) trixie; urgency=medium * Team upload diff -Nru kamailio-6.0.1/debian/patches/series kamailio-6.0.1/debian/patches/series --- kamailio-6.0.1/debian/patches/series 2025-08-28 10:54:46.000000000 +0000 +++ kamailio-6.0.1/debian/patches/series 2026-09-08 21:48:12.000000000 +0000 @@ -1,6 +1,33 @@ -# debian fixes no_lib64_on_64_bits.patch no_INSTALL_file.patch fix_export.patch stop-setting-march-on-arm.patch Check-only-major-OpenSSL-version.patch +# CVE-2026-39863 +upstream/core-tcp-read-check-coontent-lenght-for-max-int-limi.patch +# CVE-2026-39864 +upstream/auth-propagate-auth-header-via-pv_authenticate.patch +upstream/auth-init-variable.patch +upstream/auth_db-init-variable-and-set-the-result-header-late.patch +upstream/auth-add-defines-for-authenticate-flags.patch +upstream/auth-use-AUTH_FLAG_NOINVNC-flag.patch +# CVE-2026-52022 +upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free.patch +upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free-ta.patch +upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free-ta3.patch +upstream/ims_ipsec_pcscf-free-previous-sec-agree-value-at-pro.patch +# CVE-2026-52023 +upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre.patch +upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre2.patch +upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre3.patch +upstream/ims_registrar_pcscf-free-previous-sec-agree-value-at.patch +# CVE-2026-82608 +upstream/ims_auth-check-len-before-get_4bytes.patch +upstream/ims_charging-check-len-before-get_4bytes.patch +upstream/ims_icscf-check-len-before-get_4bytes.patch +upstream/ims_ocs-Free-after-copying-the-values.patch +upstream/ims_ocs-check-len-before-get_4bytes.patch +upstream/ims_qos-check-len-before-get_4bytes.patch +upstream/ims_qos_npn-check-len-before-get_4bytes.patch +upstream/ims_registrar_scscf-check-len-before-get_4bytes.patch + diff -Nru kamailio-6.0.1/debian/patches/upstream/auth-add-defines-for-authenticate-flags.patch kamailio-6.0.1/debian/patches/upstream/auth-add-defines-for-authenticate-flags.patch --- kamailio-6.0.1/debian/patches/upstream/auth-add-defines-for-authenticate-flags.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/auth-add-defines-for-authenticate-flags.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,71 @@ +From: Daniel-Constantin Mierla +Date: Sun, 23 Nov 2025 11:38:07 +0100 +Subject: auth: add defines for authenticate flags + +(cherry picked from commit cd88ca4bb64a8d44e2ea9f73be53b24d3b3a93fa) +--- + src/modules/auth/api.h | 16 ++++++++++++++++ + src/modules/auth/auth_mod.c | 8 ++++---- + 2 files changed, 20 insertions(+), 4 deletions(-) + +diff --git a/src/modules/auth/api.h b/src/modules/auth/api.h +index 89b2734..397edeb 100644 +--- a/src/modules/auth/api.h ++++ b/src/modules/auth/api.h +@@ -60,6 +60,22 @@ typedef enum auth_cfg_result + #define AUTH_CHECK_ID_F 1 << 0 + #define AUTH_CHECK_SKIPFWD_F 1 << 1 + ++/** ++ * flags to control auth functions ++ */ ++/* password parameter is HA1 format */ ++#define AUTH_FLAG_PASSWDHA1 1 ++/* challenge header with no qop and add it to avp */ ++#define AUTH_FLAG_HDRQOPNONE 2 ++/* challenge header with qop=auth and add it to avp */ ++#define AUTH_FLAG_HDRQOPAUTH 4 ++/* challenge header with qop=auth-int and add it to avp */ ++#define AUTH_FLAG_HDRQOPAUTHINT 8 ++/* challenge header with stale=true */ ++#define AUTH_FLAG_CLGSTALE 16 ++/* do not invalidate nc on authentication failure */ ++#define AUTH_FLAG_NOINVNC 32 ++ + /** + * return codes to auth API functions + */ +diff --git a/src/modules/auth/auth_mod.c b/src/modules/auth/auth_mod.c +index b1da97a..57b393c 100644 +--- a/src/modules/auth/auth_mod.c ++++ b/src/modules/auth/auth_mod.c +@@ -617,7 +617,7 @@ int pv_authenticate(struct sip_msg *msg, str *realm, str *passwd, int flags, + cred = (auth_body_t *)h->parsed; + + /* compute HA1 if needed */ +- if((flags & 1) == 0) { ++ if((flags & AUTH_FLAG_PASSWDHA1) == 0) { + /* Plaintext password is stored in PV, calculate HA1 */ + calc_HA1( + HA_MD5, &cred->digest.username.whole, realm, passwd, 0, 0, ha1); +@@ -647,7 +647,7 @@ int pv_authenticate(struct sip_msg *msg, str *realm, str *passwd, int flags, + + #ifdef USE_NC + /* On success we need to update the nonce if flag 32 is set */ +- if(nc_enabled && ret == AUTH_OK && (flags & 32)) { ++ if(nc_enabled && ret == AUTH_OK && (flags & AUTH_FLAG_NOINVNC)) { + if(check_nonce(cred, &secret1, &secret2, msg, 1) < 0) { + LM_ERR("check_nonce failed after post_auth"); + ret = AUTH_ERROR; +@@ -663,9 +663,9 @@ end: + /* check if required to add challenge header as avp */ + if(!(flags & 14)) + return ret; +- if(flags & 8) { ++ if(flags & AUTH_FLAG_HDRQOPAUTHINT) { + qop = &auth_qauthint; +- } else if(flags & 4) { ++ } else if(flags & AUTH_FLAG_HDRQOPAUTH) { + qop = &auth_qauth; + } + if(get_challenge_hf(msg, (cred ? cred->stale : 0), realm, NULL, diff -Nru kamailio-6.0.1/debian/patches/upstream/auth-init-variable.patch kamailio-6.0.1/debian/patches/upstream/auth-init-variable.patch --- kamailio-6.0.1/debian/patches/upstream/auth-init-variable.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/auth-init-variable.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,22 @@ +From: Daniel-Constantin Mierla +Date: Sun, 23 Nov 2025 11:19:06 +0100 +Subject: auth: init variable + +(cherry picked from commit 6d99a650cb79ec5551bb1af29132be9e9c7c555b) +--- + src/modules/auth/auth_mod.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/modules/auth/auth_mod.c b/src/modules/auth/auth_mod.c +index 7bedd43..b1da97a 100644 +--- a/src/modules/auth/auth_mod.c ++++ b/src/modules/auth/auth_mod.c +@@ -559,7 +559,7 @@ static int auth_check_hdr_md5_noupdate( + int pv_authenticate(struct sip_msg *msg, str *realm, str *passwd, int flags, + int hftype, hdr_field_t **hdr, str *method) + { +- struct hdr_field *h; ++ struct hdr_field *h = NULL; + auth_body_t *cred; + auth_cfg_result_t ret; + auth_result_t rauth; diff -Nru kamailio-6.0.1/debian/patches/upstream/auth-propagate-auth-header-via-pv_authenticate.patch kamailio-6.0.1/debian/patches/upstream/auth-propagate-auth-header-via-pv_authenticate.patch --- kamailio-6.0.1/debian/patches/upstream/auth-propagate-auth-header-via-pv_authenticate.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/auth-propagate-auth-header-via-pv_authenticate.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,126 @@ +From: Daniel-Constantin Mierla +Date: Sun, 23 Nov 2025 09:18:48 +0100 +Subject: auth: propagate auth header via pv_authenticate() + +(cherry picked from commit aa14327b826ac3dfa348c33fe1e9d354cdd855af) +--- + src/modules/auth/api.h | 4 ++-- + src/modules/auth/auth_mod.c | 30 ++++++++++++++++-------------- + 2 files changed, 18 insertions(+), 16 deletions(-) + +diff --git a/src/modules/auth/api.h b/src/modules/auth/api.h +index 75d95b8..89b2734 100644 +--- a/src/modules/auth/api.h ++++ b/src/modules/auth/api.h +@@ -119,9 +119,9 @@ int auth_challenge_hftype( + struct sip_msg *msg, str *realm, int flags, int hftype); + + typedef int (*pv_authenticate_f)(struct sip_msg *msg, str *realm, str *passwd, +- int flags, int hftype, str *method); ++ int flags, int hftype, hdr_field_t **hdr, str *method); + int pv_authenticate(struct sip_msg *msg, str *realm, str *passwd, int flags, +- int hftype, str *method); ++ int hftype, hdr_field_t **hdr, str *method); + + typedef int (*consume_credentials_f)(struct sip_msg *msg); + int consume_credentials(struct sip_msg *msg); +diff --git a/src/modules/auth/auth_mod.c b/src/modules/auth/auth_mod.c +index cf0ede4..7bedd43 100644 +--- a/src/modules/auth/auth_mod.c ++++ b/src/modules/auth/auth_mod.c +@@ -557,7 +557,7 @@ static int auth_check_hdr_md5_noupdate( + * @brief do WWW-Digest authentication with password taken from cfg var + */ + int pv_authenticate(struct sip_msg *msg, str *realm, str *passwd, int flags, +- int hftype, str *method) ++ int hftype, hdr_field_t **hdr, str *method) + { + struct hdr_field *h; + auth_body_t *cred; +@@ -656,6 +656,9 @@ int pv_authenticate(struct sip_msg *msg, str *realm, str *passwd, int flags, + #endif + + end: ++ if(hdr != NULL) { ++ *hdr = h; ++ } + if(ret < 0) { + /* check if required to add challenge header as avp */ + if(!(flags & 14)) +@@ -692,7 +695,7 @@ end: + static int ki_pv_proxy_authenticate( + sip_msg_t *msg, str *realm, str *passwd, int flags) + { +- return pv_authenticate(msg, realm, passwd, flags, HDR_PROXYAUTH_T, ++ return pv_authenticate(msg, realm, passwd, flags, HDR_PROXYAUTH_T, NULL, + &msg->first_line.u.request.method); + } + +@@ -731,7 +734,7 @@ static int pv_proxy_authenticate( + goto error; + } + return pv_authenticate(msg, &srealm, &spasswd, vflags, HDR_PROXYAUTH_T, +- &msg->first_line.u.request.method); ++ NULL, &msg->first_line.u.request.method); + + error: + return AUTH_ERROR; +@@ -743,7 +746,7 @@ error: + static int ki_pv_www_authenticate( + sip_msg_t *msg, str *realm, str *passwd, int flags) + { +- return pv_authenticate(msg, realm, passwd, flags, HDR_AUTHORIZATION_T, ++ return pv_authenticate(msg, realm, passwd, flags, HDR_AUTHORIZATION_T, NULL, + &msg->first_line.u.request.method); + } + +@@ -754,7 +757,7 @@ static int ki_pv_www_authenticate_method( + sip_msg_t *msg, str *realm, str *passwd, int flags, str *method) + { + return pv_authenticate( +- msg, realm, passwd, flags, HDR_AUTHORIZATION_T, method); ++ msg, realm, passwd, flags, HDR_AUTHORIZATION_T, NULL, method); + } + + /** +@@ -792,7 +795,7 @@ static int pv_www_authenticate( + goto error; + } + return pv_authenticate(msg, &srealm, &spasswd, vflags, HDR_AUTHORIZATION_T, +- &msg->first_line.u.request.method); ++ NULL, &msg->first_line.u.request.method); + + error: + return AUTH_ERROR; +@@ -841,8 +844,8 @@ static int pv_www_authenticate2(struct sip_msg *msg, char *realm, char *passwd, + goto error; + } + +- return pv_authenticate( +- msg, &srealm, &spasswd, vflags, HDR_AUTHORIZATION_T, &smethod); ++ return pv_authenticate(msg, &srealm, &spasswd, vflags, HDR_AUTHORIZATION_T, ++ NULL, &smethod); + + error: + return AUTH_ERROR; +@@ -861,15 +864,14 @@ static int pv_auth_check( + sip_uri_t *furi = NULL; + str suser; + +- if(msg->REQ_METHOD == METHOD_REGISTER) ++ if(msg->REQ_METHOD == METHOD_REGISTER) { + ret = pv_authenticate(msg, srealm, spasswd, vflags, HDR_AUTHORIZATION_T, +- &msg->first_line.u.request.method); +- else ++ &hdr, &msg->first_line.u.request.method); ++ } else { + ret = pv_authenticate(msg, srealm, spasswd, vflags, HDR_PROXYAUTH_T, +- &msg->first_line.u.request.method); +- ++ &hdr, &msg->first_line.u.request.method); ++ } + if(ret == AUTH_OK && (vchecks & AUTH_CHECK_ID_F)) { +- hdr = (msg->proxy_auth == 0) ? msg->authorization : msg->proxy_auth; + if(hdr == NULL) { + if(msg->REQ_METHOD & (METHOD_ACK | METHOD_CANCEL | METHOD_PRACK)) { + return AUTH_OK; diff -Nru kamailio-6.0.1/debian/patches/upstream/auth-use-AUTH_FLAG_NOINVNC-flag.patch kamailio-6.0.1/debian/patches/upstream/auth-use-AUTH_FLAG_NOINVNC-flag.patch --- kamailio-6.0.1/debian/patches/upstream/auth-use-AUTH_FLAG_NOINVNC-flag.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/auth-use-AUTH_FLAG_NOINVNC-flag.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,22 @@ +From: Daniel-Constantin Mierla +Date: Wed, 26 Nov 2025 20:43:25 +0100 +Subject: auth: use AUTH_FLAG_NOINVNC flag + +(cherry picked from commit 9dc160d1d2bdf0542d3d9d8ae090bb1352520a1c) +--- + src/modules/auth/auth_mod.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/modules/auth/auth_mod.c b/src/modules/auth/auth_mod.c +index 57b393c..31bebc8 100644 +--- a/src/modules/auth/auth_mod.c ++++ b/src/modules/auth/auth_mod.c +@@ -573,7 +573,7 @@ int pv_authenticate(struct sip_msg *msg, str *realm, str *passwd, int flags, + ret = AUTH_ERROR; + + #ifdef USE_NC +- if(nc_enabled && (flags & 32)) ++ if(nc_enabled && (flags & AUTH_FLAG_NOINVNC)) + check_auth_hdr = auth_check_hdr_md5_noupdate; + #endif + diff -Nru kamailio-6.0.1/debian/patches/upstream/auth_db-init-variable-and-set-the-result-header-late.patch kamailio-6.0.1/debian/patches/upstream/auth_db-init-variable-and-set-the-result-header-late.patch --- kamailio-6.0.1/debian/patches/upstream/auth_db-init-variable-and-set-the-result-header-late.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/auth_db-init-variable-and-set-the-result-header-late.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,41 @@ +From: Daniel-Constantin Mierla +Date: Sun, 23 Nov 2025 11:21:04 +0100 +Subject: auth_db: init variable and set the result header later + +(cherry picked from commit c2e62cd2dfb0c9969f7e410020fa3a39f343d608) +--- + src/modules/auth_db/authorize.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/src/modules/auth_db/authorize.c b/src/modules/auth_db/authorize.c +index a1629f0..f1c4b6d 100644 +--- a/src/modules/auth_db/authorize.c ++++ b/src/modules/auth_db/authorize.c +@@ -237,7 +237,7 @@ static int digest_authenticate_hdr(sip_msg_t *msg, str *realm, str *table, + char ha1[256]; + auth_cfg_result_t ret; + auth_result_t rauth; +- struct hdr_field *h; ++ struct hdr_field *h = NULL; + auth_body_t *cred; + db1_res_t *result = NULL; + +@@ -283,8 +283,6 @@ static int digest_authenticate_hdr(sip_msg_t *msg, str *realm, str *table, + } + + cred = (auth_body_t *)h->parsed; +- if(ahdr != NULL) +- *ahdr = h; + + rauth = get_ha1(&cred->digest.username, realm, table, ha1, &result); + if(rauth < 0) { +@@ -326,6 +324,9 @@ static int digest_authenticate_hdr(sip_msg_t *msg, str *realm, str *table, + } + + end: ++ if(ahdr != NULL) { ++ *ahdr = h; ++ } + if(result) + auth_dbf.free_result(auth_db_handle, result); + return ret; diff -Nru kamailio-6.0.1/debian/patches/upstream/core-tcp-read-check-coontent-lenght-for-max-int-limi.patch kamailio-6.0.1/debian/patches/upstream/core-tcp-read-check-coontent-lenght-for-max-int-limi.patch --- kamailio-6.0.1/debian/patches/upstream/core-tcp-read-check-coontent-lenght-for-max-int-limi.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/core-tcp-read-check-coontent-lenght-for-max-int-limi.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,32 @@ +From: Daniel-Constantin Mierla +Date: Sun, 1 Mar 2026 22:55:21 +0100 +Subject: core: tcp read - check coontent lenght for max int limit + +(cherry picked from commit 2c47fe1625b57e04252230e0e783ba4182afbebb) +(cherry picked from commit 4076b32435b32205460e4d5fbcbef3ed8500e8c7) +--- + src/core/tcp_read.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/src/core/tcp_read.c b/src/core/tcp_read.c +index 2cf2424..0ea59d1 100644 +--- a/src/core/tcp_read.c ++++ b/src/core/tcp_read.c +@@ -859,7 +859,16 @@ int tcp_read_headers(struct tcp_connection *c, rd_conn_flags_t *read_flags) + case '7': + case '8': + case '9': +- r->content_len = r->content_len * 10 + (*p - '0'); ++ if(r->content_len >= INT_MAX / 10) { ++ LM_ERR("large Content-Length header value %d in" ++ " state %d\n", ++ r->content_len, r->state); ++ r->content_len = 0; ++ r->error = TCP_REQ_BAD_LEN; ++ r->state = H_SKIP; /* skip now */ ++ } else { ++ r->content_len = r->content_len * 10 + (*p - '0'); ++ } + break; + case '\r': + case ' ': diff -Nru kamailio-6.0.1/debian/patches/upstream/ims_auth-check-len-before-get_4bytes.patch kamailio-6.0.1/debian/patches/upstream/ims_auth-check-len-before-get_4bytes.patch --- kamailio-6.0.1/debian/patches/upstream/ims_auth-check-len-before-get_4bytes.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/ims_auth-check-len-before-get_4bytes.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,69 @@ +From: Victor Seva +Date: Tue, 14 Jul 2026 12:01:38 +0200 +Subject: ims_auth: check len before get_4bytes() + +(cherry picked from commit 4794df44bf5195594b9b86a8f7e96222f23413b1) +(cherry picked from commit 675e0d53084e12cc1b78be020d1e81bde2863873) +--- + src/modules/ims_auth/cxdx_avp.c | 27 ++++++++++++++++++--------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +diff --git a/src/modules/ims_auth/cxdx_avp.c b/src/modules/ims_auth/cxdx_avp.c +index 51652ae..90f31e3 100644 +--- a/src/modules/ims_auth/cxdx_avp.c ++++ b/src/modules/ims_auth/cxdx_avp.c +@@ -305,7 +305,7 @@ int cxdx_get_result_code(AAAMessage *msg, int *data) + { + str s; + s = cxdx_get_avp(msg, AVP_Result_Code, 0, __FUNCTION__); +- if(!s.s) ++ if(!s.s || s.len < 4) + return 0; + *data = get_4bytes(s.s); + return 1; +@@ -329,7 +329,7 @@ int cxdx_get_experimental_result_code(AAAMessage *msg, int *data) + + avp = cdpb.AAAFindMatchingAVPList( + list, 0, AVP_IMS_Experimental_Result_Code, 0, 0); +- if(!avp || !avp->data.s) { ++ if(!avp || !avp->data.s || avp->data.len < 4) { + cdpb.AAAFreeAVPList(&list); + return 0; + } +@@ -407,12 +407,21 @@ int cxdx_get_capabilities(AAAMessage *msg, int **m, int *m_cnt, int **o, + *o_cnt = 0; + *p_cnt = 0; + while(avp) { +- if(avp->code == AVP_IMS_Mandatory_Capability) +- (*m)[(*m_cnt)++] = get_4bytes(avp->data.s); +- if(avp->code == AVP_IMS_Optional_Capability) +- (*o)[(*o_cnt)++] = get_4bytes(avp->data.s); +- if(avp->code == AVP_IMS_Server_Name) +- (*p)[(*p_cnt)++] = avp->data; ++ switch(avp->code) { ++ case AVP_IMS_Mandatory_Capability: ++ if(!avp->data.s || avp->data.len < 4) ++ break; ++ (*m)[(*m_cnt)++] = get_4bytes(avp->data.s); ++ break; ++ case AVP_IMS_Optional_Capability: ++ if(!avp->data.s || avp->data.len < 4) ++ break; ++ (*o)[(*o_cnt)++] = get_4bytes(avp->data.s); ++ break; ++ case AVP_IMS_Server_Name: ++ (*p)[(*p_cnt)++] = avp->data; ++ break; ++ } + avp = avp->next; + } + cdpb.AAAFreeAVPList(&list); +@@ -539,7 +548,7 @@ int cxdx_get_sip_number_auth_items(AAAMessage *msg, int *data) + str s; + s = cxdx_get_avp(msg, AVP_IMS_SIP_Number_Auth_Items, IMS_vendor_id_3GPP, + __FUNCTION__); +- if(!s.s) ++ if(!s.s || s.len < 4) + return 0; + *data = get_4bytes(s.s); + return 1; diff -Nru kamailio-6.0.1/debian/patches/upstream/ims_charging-check-len-before-get_4bytes.patch kamailio-6.0.1/debian/patches/upstream/ims_charging-check-len-before-get_4bytes.patch --- kamailio-6.0.1/debian/patches/upstream/ims_charging-check-len-before-get_4bytes.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/ims_charging-check-len-before-get_4bytes.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,86 @@ +From: Victor Seva +Date: Tue, 14 Jul 2026 12:04:42 +0200 +Subject: ims_charging: check len before get_4bytes() + +(cherry picked from commit 835e94e2795c932a3c62262cf4f7567955520ab8) +(cherry picked from commit 5dae7c5a7d2910844aaea4f6a0d68dca429bd393) +--- + src/modules/ims_charging/ccr.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/src/modules/ims_charging/ccr.c b/src/modules/ims_charging/ccr.c +index 79dce87..1c9e934 100644 +--- a/src/modules/ims_charging/ccr.c ++++ b/src/modules/ims_charging/ccr.c +@@ -365,10 +365,14 @@ Ro_CCA_t *Ro_parse_CCA_avps(AAAMessage *cca) + while(avp != NULL) { + switch(avp->code) { + case AVP_CC_Request_Type: ++ if(!avp->data.s || avp->data.len < 4) ++ break; + x = get_4bytes(avp->data.s); + ro_cca_data->cc_request_type = x; + break; + case AVP_CC_Request_Number: ++ if(!avp->data.s || avp->data.len < 4) ++ break; + x = get_4bytes(avp->data.s); + ro_cca_data->cc_request_number = x; + break; +@@ -388,6 +392,8 @@ Ro_CCA_t *Ro_parse_CCA_avps(AAAMessage *cca) + while(z) { + switch(z->code) { + case AVP_CC_Time: ++ if(!z->data.s || z->data.len < 4) ++ break; + mscc->granted_service_unit->cc_time = + get_4bytes(z->data.s); + break; +@@ -401,13 +407,19 @@ Ro_CCA_t *Ro_parse_CCA_avps(AAAMessage *cca) + cdp_avp->cdp->AAAFreeAVPList(&y); + break; + case AVP_Validity_Time: ++ if(!mscc_avp->data.s || mscc_avp->data.len < 4) ++ break; + mscc->validity_time = get_4bytes(mscc_avp->data.s); + break; + case AVP_Time_Quota_Threshold: ++ if(!mscc_avp->data.s || mscc_avp->data.len < 4) ++ break; + mscc->time_quota_threshold = + get_4bytes(mscc_avp->data.s); + break; + case AVP_Result_Code: ++ if(!mscc_avp->data.s || mscc_avp->data.len < 4) ++ break; + mscc->resultcode = get_4bytes(mscc_avp->data.s); + break; + case AVP_Final_Unit_Indication: +@@ -416,6 +428,8 @@ Ro_CCA_t *Ro_parse_CCA_avps(AAAMessage *cca) + while(z) { + switch(z->code) { + case AVP_Final_Unit_Action: ++ if(!z->data.s || z->data.len < 4) ++ break; + mscc->final_unit_action->action = + get_4bytes(z->data.s); + break; +@@ -439,6 +453,9 @@ Ro_CCA_t *Ro_parse_CCA_avps(AAAMessage *cca) + case AVP_Redirect_Address_Type: + LM_DBG("Received redirect " + "address type\n"); ++ if(!zz->data.s ++ || zz->data.len < 4) ++ break; + mscc->final_unit_action + ->redirect_server + ->address_type = +@@ -480,6 +497,8 @@ Ro_CCA_t *Ro_parse_CCA_avps(AAAMessage *cca) + cdp_avp->cdp->AAAFreeAVPList(mscc_avp_list_ptr); + break; + case AVP_Result_Code: ++ if(!avp->data.s || avp->data.len < 4) ++ break; + x = get_4bytes(avp->data.s); + ro_cca_data->resultcode = x; + break; diff -Nru kamailio-6.0.1/debian/patches/upstream/ims_icscf-check-len-before-get_4bytes.patch kamailio-6.0.1/debian/patches/upstream/ims_icscf-check-len-before-get_4bytes.patch --- kamailio-6.0.1/debian/patches/upstream/ims_icscf-check-len-before-get_4bytes.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/ims_icscf-check-len-before-get_4bytes.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,69 @@ +From: Victor Seva +Date: Tue, 14 Jul 2026 12:14:12 +0200 +Subject: ims_icscf: check len before get_4bytes() + +(cherry picked from commit fd208b0fab7eba80ea4b80e9ff1c22c733619b65) +(cherry picked from commit fc616d62e44bee65de3e83cd3ec7e10742b9aec9) +--- + src/modules/ims_icscf/cxdx_avp.c | 27 ++++++++++++++++++--------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +diff --git a/src/modules/ims_icscf/cxdx_avp.c b/src/modules/ims_icscf/cxdx_avp.c +index 95fe98d..fa5637f 100644 +--- a/src/modules/ims_icscf/cxdx_avp.c ++++ b/src/modules/ims_icscf/cxdx_avp.c +@@ -294,7 +294,7 @@ int cxdx_get_result_code(AAAMessage *msg, int *data) + { + str s; + s = cxdx_get_avp(msg, AVP_Result_Code, 0, __FUNCTION__); +- if(!s.s) ++ if(!s.s || s.len < 4) + return 0; + *data = get_4bytes(s.s); + return 1; +@@ -318,7 +318,7 @@ int cxdx_get_experimental_result_code(AAAMessage *msg, int *data) + + avp = cdpb.AAAFindMatchingAVPList( + list, 0, AVP_IMS_Experimental_Result_Code, 0, 0); +- if(!avp || !avp->data.s) { ++ if(!avp || !avp->data.s || avp->data.len < 4) { + cdpb.AAAFreeAVPList(&list); + return 0; + } +@@ -396,12 +396,21 @@ int cxdx_get_capabilities(AAAMessage *msg, int **m, int *m_cnt, int **o, + *o_cnt = 0; + *p_cnt = 0; + while(avp) { +- if(avp->code == AVP_IMS_Mandatory_Capability) +- (*m)[(*m_cnt)++] = get_4bytes(avp->data.s); +- if(avp->code == AVP_IMS_Optional_Capability) +- (*o)[(*o_cnt)++] = get_4bytes(avp->data.s); +- if(avp->code == AVP_IMS_Server_Name) +- (*p)[(*p_cnt)++] = avp->data; ++ switch(avp->code) { ++ case AVP_IMS_Mandatory_Capability: ++ if(!avp->data.s || avp->data.len < 4) ++ break; ++ (*m)[(*m_cnt)++] = get_4bytes(avp->data.s); ++ break; ++ case AVP_IMS_Optional_Capability: ++ if(!avp->data.s || avp->data.len < 4) ++ break; ++ (*o)[(*o_cnt)++] = get_4bytes(avp->data.s); ++ break; ++ case AVP_IMS_Server_Name: ++ (*p)[(*p_cnt)++] = avp->data; ++ break; ++ } + avp = avp->next; + } + cdpb.AAAFreeAVPList(&list); +@@ -510,7 +519,7 @@ int cxdx_get_sip_number_auth_items(AAAMessage *msg, int *data) + str s; + s = cxdx_get_avp(msg, AVP_IMS_SIP_Number_Auth_Items, IMS_vendor_id_3GPP, + __FUNCTION__); +- if(!s.s) ++ if(!s.s || s.len < 4) + return 0; + *data = get_4bytes(s.s); + return 1; diff -Nru kamailio-6.0.1/debian/patches/upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free-ta.patch kamailio-6.0.1/debian/patches/upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free-ta.patch --- kamailio-6.0.1/debian/patches/upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free-ta.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free-ta.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,26 @@ +From: Victor Seva +Date: Mon, 4 May 2026 11:07:33 +0200 +Subject: ims_ipsec_pcscf: Fix problems with double mem free, take two + +related #4670 + +(cherry picked from commit d6e94a640097f31e14df652b039f017a90f20872) +(cherry picked from commit e47d4792de562b767d0796662525da902b270df3) +--- + src/modules/ims_ipsec_pcscf/sec_agree.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/modules/ims_ipsec_pcscf/sec_agree.c b/src/modules/ims_ipsec_pcscf/sec_agree.c +index 72425a5..98a0a21 100644 +--- a/src/modules/ims_ipsec_pcscf/sec_agree.c ++++ b/src/modules/ims_ipsec_pcscf/sec_agree.c +@@ -246,7 +246,8 @@ cleanup: + // Function - free_security() + // Keep them in sync! + if(params) { +- shm_free(params->sec_header.s); ++ if(params->sec_header.s) ++ shm_free(params->sec_header.s); + + if(params->type == SECURITY_IPSEC && params->data.ipsec) { + if(params->data.ipsec->ealg.s) diff -Nru kamailio-6.0.1/debian/patches/upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free-ta3.patch kamailio-6.0.1/debian/patches/upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free-ta3.patch --- kamailio-6.0.1/debian/patches/upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free-ta3.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free-ta3.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,27 @@ +From: Victor Seva +Date: Mon, 4 May 2026 11:40:10 +0200 +Subject: ims_ipsec_pcscf: Fix problems with double mem free, take three + +related #4670 + +* free paramas->data.ipsec always + +(cherry picked from commit c257ac9aeabadabc24be8e59dee6e85b74d556e2) +(cherry picked from commit de4fc33ce90c3c11382eff3e8dc4789e0ec8c084) +--- + src/modules/ims_ipsec_pcscf/sec_agree.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/src/modules/ims_ipsec_pcscf/sec_agree.c b/src/modules/ims_ipsec_pcscf/sec_agree.c +index 98a0a21..d52c011 100644 +--- a/src/modules/ims_ipsec_pcscf/sec_agree.c ++++ b/src/modules/ims_ipsec_pcscf/sec_agree.c +@@ -267,6 +267,8 @@ cleanup: + if(params->data.ipsec->mod.s) + shm_free(params->data.ipsec->mod.s); + shm_free(params->data.ipsec); ++ } else { ++ shm_free(params->data.ipsec); + } + + shm_free(params); diff -Nru kamailio-6.0.1/debian/patches/upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free.patch kamailio-6.0.1/debian/patches/upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free.patch --- kamailio-6.0.1/debian/patches/upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/ims_ipsec_pcscf-Fix-problems-with-double-mem-free.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,49 @@ +From: Victor Seva +Date: Mon, 4 May 2026 10:45:44 +0200 +Subject: ims_ipsec_pcscf: Fix problems with double mem free + +fix #4670 + +same logic as 91c5ca751799db4f25a28a495350cc97f7c2f390 + +(cherry picked from commit c7f290cc92760365af81f99c290a905d4e5c609c) +(cherry picked from commit d04659303e7fbfb55d0884dedc6dde6ceac7c51b) +--- + src/modules/ims_ipsec_pcscf/sec_agree.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/src/modules/ims_ipsec_pcscf/sec_agree.c b/src/modules/ims_ipsec_pcscf/sec_agree.c +index 8a785c3..72425a5 100644 +--- a/src/modules/ims_ipsec_pcscf/sec_agree.c ++++ b/src/modules/ims_ipsec_pcscf/sec_agree.c +@@ -249,14 +249,22 @@ cleanup: + shm_free(params->sec_header.s); + + if(params->type == SECURITY_IPSEC && params->data.ipsec) { +- shm_free(params->data.ipsec->ealg.s); +- shm_free(params->data.ipsec->r_ealg.s); +- shm_free(params->data.ipsec->ck.s); +- shm_free(params->data.ipsec->alg.s); +- shm_free(params->data.ipsec->r_alg.s); +- shm_free(params->data.ipsec->ik.s); +- shm_free(params->data.ipsec->prot.s); +- shm_free(params->data.ipsec->mod.s); ++ if(params->data.ipsec->ealg.s) ++ shm_free(params->data.ipsec->ealg.s); ++ if(params->data.ipsec->r_ealg.s) ++ shm_free(params->data.ipsec->r_ealg.s); ++ if(params->data.ipsec->ck.s) ++ shm_free(params->data.ipsec->ck.s); ++ if(params->data.ipsec->alg.s) ++ shm_free(params->data.ipsec->alg.s); ++ if(params->data.ipsec->r_alg.s) ++ shm_free(params->data.ipsec->r_alg.s); ++ if(params->data.ipsec->ik.s) ++ shm_free(params->data.ipsec->ik.s); ++ if(params->data.ipsec->prot.s) ++ shm_free(params->data.ipsec->prot.s); ++ if(params->data.ipsec->mod.s) ++ shm_free(params->data.ipsec->mod.s); + shm_free(params->data.ipsec); + } + diff -Nru kamailio-6.0.1/debian/patches/upstream/ims_ipsec_pcscf-free-previous-sec-agree-value-at-pro.patch kamailio-6.0.1/debian/patches/upstream/ims_ipsec_pcscf-free-previous-sec-agree-value-at-pro.patch --- kamailio-6.0.1/debian/patches/upstream/ims_ipsec_pcscf-free-previous-sec-agree-value-at-pro.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/ims_ipsec_pcscf-free-previous-sec-agree-value-at-pro.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,34 @@ +From: Victor Seva +Date: Tue, 28 Jul 2026 18:58:08 +0200 +Subject: ims_ipsec_pcscf: free previous sec-agree value at + process_sec_agree_param() + +process_sec_agree_param() can be called several times for the same parameter +in this case we will leak the mem for the previous value. + +Based on solution from qasimomneia at #4841 + +(cherry picked from commit f0e3348c5e3a6c24b2921fbfb8b998317076146f) +(cherry picked from commit 56f30c96a22eb0437090d4c376ac2eca67a93508) +--- + src/modules/ims_ipsec_pcscf/sec_agree.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/modules/ims_ipsec_pcscf/sec_agree.c b/src/modules/ims_ipsec_pcscf/sec_agree.c +index d52c011..5975536 100644 +--- a/src/modules/ims_ipsec_pcscf/sec_agree.c ++++ b/src/modules/ims_ipsec_pcscf/sec_agree.c +@@ -70,8 +70,13 @@ static void trim_whitespaces(str *string) + } + + #define SEC_COPY_STR_PARAM(DST, SRC) \ ++ if(DST.s != NULL) { \ ++ shm_free(DST.s); \ ++ } \ + DST.s = shm_malloc(SRC.len); \ + if(DST.s == NULL) { \ ++ SHM_MEM_ERROR; \ ++ DST.len = 0; \ + return -1; \ + } \ + memcpy(DST.s, SRC.s, SRC.len); \ diff -Nru kamailio-6.0.1/debian/patches/upstream/ims_ocs-Free-after-copying-the-values.patch kamailio-6.0.1/debian/patches/upstream/ims_ocs-Free-after-copying-the-values.patch --- kamailio-6.0.1/debian/patches/upstream/ims_ocs-Free-after-copying-the-values.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/ims_ocs-Free-after-copying-the-values.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,26 @@ +From: Xenofon Karamanos +Date: Tue, 31 Mar 2026 10:52:11 +0000 +Subject: ims_ocs: Free after copying the values + +- Remove extra freeavplist call +- Add len check + +(cherry picked from commit a56942affd35d41890c23f1d3b5bb519f87ef5ad) +--- + src/modules/ims_ocs/ocs_avp_helper.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/src/modules/ims_ocs/ocs_avp_helper.c b/src/modules/ims_ocs/ocs_avp_helper.c +index f350a79..378b2a2 100644 +--- a/src/modules/ims_ocs/ocs_avp_helper.c ++++ b/src/modules/ims_ocs/ocs_avp_helper.c +@@ -208,8 +208,7 @@ int getUnits(AAAMessage *msg, int *used, int *service, int *group) + list2 = cdp_avp->cdp->AAAUngroupAVPS(req_units->data); + value = cdpb.AAAFindMatchingAVPList( + list2, list2.head, AVP_CC_Time, 0, 0); +- cdpb.AAAFreeAVPList(&list2); +- if(value) ++ if(value && value->data.len >= 4) + units = get_4bytes(value->data.s); + cdpb.AAAFreeAVPList(&list2); + } diff -Nru kamailio-6.0.1/debian/patches/upstream/ims_ocs-check-len-before-get_4bytes.patch kamailio-6.0.1/debian/patches/upstream/ims_ocs-check-len-before-get_4bytes.patch --- kamailio-6.0.1/debian/patches/upstream/ims_ocs-check-len-before-get_4bytes.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/ims_ocs-check-len-before-get_4bytes.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,95 @@ +From: Victor Seva +Date: Tue, 14 Jul 2026 12:23:39 +0200 +Subject: ims_ocs: check len before get_4bytes() + +(cherry picked from commit f30c4aa8b54320fef295c68d72c4b1d87b1b9c04) +(cherry picked from commit ce354d25a70b94d9f240bba317569529233c4299) +--- + src/modules/ims_ocs/msg_faker.c | 2 +- + src/modules/ims_ocs/ocs_avp_helper.c | 21 ++++++++++++++------- + 2 files changed, 15 insertions(+), 8 deletions(-) + +diff --git a/src/modules/ims_ocs/msg_faker.c b/src/modules/ims_ocs/msg_faker.c +index 89c6958..8646605 100644 +--- a/src/modules/ims_ocs/msg_faker.c ++++ b/src/modules/ims_ocs/msg_faker.c +@@ -55,7 +55,7 @@ int getMethod(AAAMessage *msg, str **method) + { + str s; + s = get_avp(msg, AVP_IMS_CCR_Type, 0, __FUNCTION__); +- if(!s.s) ++ if(!s.s || s.len < 4) + return -1; + switch(get_4bytes(s.s)) { + case RO_CC_START: +diff --git a/src/modules/ims_ocs/ocs_avp_helper.c b/src/modules/ims_ocs/ocs_avp_helper.c +index 378b2a2..7c1f23e 100644 +--- a/src/modules/ims_ocs/ocs_avp_helper.c ++++ b/src/modules/ims_ocs/ocs_avp_helper.c +@@ -66,8 +66,11 @@ int getRecordNummber(AAAMessage *msg) + if(avp == 0) { + LM_DBG("Failed finding avp\n"); + return 0; +- } else ++ } else { ++ if(!avp->data.s || avp->data.len < 4) ++ return 0; + return get_4bytes(avp->data.s); ++ } + } + + str getSubscriptionId1(AAAMessage *msg, int *type) +@@ -83,7 +86,10 @@ str getSubscriptionId1(AAAMessage *msg, int *type) + list, list.head, AVP_Subscription_Id_Data, 0, 0); + + if(avp_type) { +- *type = get_4bytes(avp_type->data.s); ++ if(!avp_type->data.s || avp_type->data.len < 4) ++ *type = 0; ++ else ++ *type = get_4bytes(avp_type->data.s); + } else { + LM_DBG("Failed finding type\n"); + *type = 0; +@@ -113,7 +119,7 @@ int isOrig(AAAMessage *msg) + list2 = cdp_avp->cdp->AAAUngroupAVPS(imsinfo->data); + role = cdpb.AAAFindMatchingAVPList(list2, list2.head, + AVP_IMS_Role_Of_Node, IMS_vendor_id_3GPP, 0); +- if(role) { ++ if(role && role->data.s && role->data.len >= 4) { + result = get_4bytes(role->data.s); + } + cdpb.AAAFreeAVPList(&list2); +@@ -208,13 +214,13 @@ int getUnits(AAAMessage *msg, int *used, int *service, int *group) + list2 = cdp_avp->cdp->AAAUngroupAVPS(req_units->data); + value = cdpb.AAAFindMatchingAVPList( + list2, list2.head, AVP_CC_Time, 0, 0); +- if(value && value->data.len >= 4) ++ if(value && value->data.s && value->data.len >= 4) + units = get_4bytes(value->data.s); + cdpb.AAAFreeAVPList(&list2); + } + service_avp = cdpb.AAAFindMatchingAVPList( + list, list.head, AVP_Service_Identifier, 0, 0); +- if(service_avp) { ++ if(service_avp && service_avp->data.s && service_avp->data.len >= 4) { + *service = get_4bytes(service_avp->data.s); + } + used_units = cdpb.AAAFindMatchingAVPList( +@@ -223,13 +229,14 @@ int getUnits(AAAMessage *msg, int *used, int *service, int *group) + list2 = cdp_avp->cdp->AAAUngroupAVPS(used_units->data); + value = cdpb.AAAFindMatchingAVPList( + list2, list2.head, AVP_CC_Time, 0, 0); +- if(value) ++ if(value && value->data.s && value->data.len >= 4) + *used = get_4bytes(value->data.s); + cdpb.AAAFreeAVPList(&list2); + } + rating_group = cdpb.AAAFindMatchingAVPList( + list, list.head, AVP_Rating_Group, 0, 0); +- if(rating_group) { ++ if(rating_group && rating_group->data.s ++ && rating_group->data.len >= 4) { + *group = get_4bytes(rating_group->data.s); + } + cdpb.AAAFreeAVPList(&list); diff -Nru kamailio-6.0.1/debian/patches/upstream/ims_qos-check-len-before-get_4bytes.patch kamailio-6.0.1/debian/patches/upstream/ims_qos-check-len-before-get_4bytes.patch --- kamailio-6.0.1/debian/patches/upstream/ims_qos-check-len-before-get_4bytes.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/ims_qos-check-len-before-get_4bytes.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,50 @@ +From: Victor Seva +Date: Tue, 14 Jul 2026 12:36:12 +0200 +Subject: ims_qos: check len before get_4bytes() + +(cherry picked from commit 45b30ecfa04c79ebc40afa76b60c17d000b65f82) +(cherry picked from commit 1a276ee343dde0454d1f28cc69c1c2bff8113541) +--- + src/modules/ims_qos/rx_avp.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/src/modules/ims_qos/rx_avp.c b/src/modules/ims_qos/rx_avp.c +index 4fb750d..66682be 100644 +--- a/src/modules/ims_qos/rx_avp.c ++++ b/src/modules/ims_qos/rx_avp.c +@@ -1313,7 +1313,7 @@ unsigned int rx_get_abort_cause(AAAMessage *msg) + //getting abort cause + avp = cdpb.AAAFindMatchingAVP(msg, msg->avpList.head, AVP_IMS_Abort_Cause, + IMS_vendor_id_3GPP, AAA_FORWARD_SEARCH); +- if(avp) { ++ if(avp && avp->data.s && avp->data.len >= 4) { + code = get_4bytes(avp->data.s); + } + return code; +@@ -1338,17 +1338,21 @@ inline int rx_get_result_code(AAAMessage *msg, unsigned int *data) + for(avp = msg->avpList.tail; avp; avp = avp->prev) { + //LOG(L_INFO,"pcc_get_result_code: looping with avp code %i\n",avp->code); + if(avp->code == AVP_Result_Code) { +- *data = get_4bytes(avp->data.s); +- ret = 1; ++ if(avp->data.s && avp->data.len >= 4) { ++ *data = get_4bytes(avp->data.s); ++ ret = 1; ++ } + + } else if(avp->code == AVP_Experimental_Result) { + list = cdpb.AAAUngroupAVPS(avp->data); + for(avp = list.head; avp; avp = avp->next) { + //LOG(L_CRIT,"in the loop with avp code %i\n",avp->code); + if(avp->code == AVP_IMS_Experimental_Result_Code) { +- *data = get_4bytes(avp->data.s); +- cdpb.AAAFreeAVPList(&list); +- ret = 1; ++ if(avp->data.s && avp->data.len >= 4) { ++ *data = get_4bytes(avp->data.s); ++ cdpb.AAAFreeAVPList(&list); ++ ret = 1; ++ } + break; + } + } diff -Nru kamailio-6.0.1/debian/patches/upstream/ims_qos_npn-check-len-before-get_4bytes.patch kamailio-6.0.1/debian/patches/upstream/ims_qos_npn-check-len-before-get_4bytes.patch --- kamailio-6.0.1/debian/patches/upstream/ims_qos_npn-check-len-before-get_4bytes.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/ims_qos_npn-check-len-before-get_4bytes.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,50 @@ +From: Victor Seva +Date: Tue, 14 Jul 2026 12:47:34 +0200 +Subject: ims_qos_npn: check len before get_4bytes() + +(cherry picked from commit e6ff84fea2da24e385b75928a3cf6d32e063d8f9) +(cherry picked from commit 801b7629fb038f1d78c787c132144141b84e13f7) +--- + src/modules/ims_qos_npn/rx_avp.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/src/modules/ims_qos_npn/rx_avp.c b/src/modules/ims_qos_npn/rx_avp.c +index fd17533..966ab04 100644 +--- a/src/modules/ims_qos_npn/rx_avp.c ++++ b/src/modules/ims_qos_npn/rx_avp.c +@@ -1313,7 +1313,7 @@ unsigned int rx_get_abort_cause(AAAMessage *msg) + //getting abort cause + avp = cdpb.AAAFindMatchingAVP(msg, msg->avpList.head, AVP_IMS_Abort_Cause, + IMS_vendor_id_3GPP, AAA_FORWARD_SEARCH); +- if(avp) { ++ if(avp && avp->data.s && avp->data.len >= 4) { + code = get_4bytes(avp->data.s); + } + return code; +@@ -1338,17 +1338,21 @@ inline int rx_get_result_code(AAAMessage *msg, unsigned int *data) + for(avp = msg->avpList.tail; avp; avp = avp->prev) { + //LOG(L_INFO,"pcc_get_result_code: looping with avp code %i\n",avp->code); + if(avp->code == AVP_Result_Code) { +- *data = get_4bytes(avp->data.s); +- ret = 1; ++ if(avp->data.s && avp->data.len >= 4) { ++ *data = get_4bytes(avp->data.s); ++ ret = 1; ++ } + + } else if(avp->code == AVP_Experimental_Result) { + list = cdpb.AAAUngroupAVPS(avp->data); + for(avp = list.head; avp; avp = avp->next) { + //LOG(L_CRIT,"in the loop with avp code %i\n",avp->code); + if(avp->code == AVP_IMS_Experimental_Result_Code) { +- *data = get_4bytes(avp->data.s); +- cdpb.AAAFreeAVPList(&list); +- ret = 1; ++ if(avp->data.s && avp->data.len >= 4) { ++ *data = get_4bytes(avp->data.s); ++ cdpb.AAAFreeAVPList(&list); ++ ret = 1; ++ } + break; + } + } diff -Nru kamailio-6.0.1/debian/patches/upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre.patch kamailio-6.0.1/debian/patches/upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre.patch --- kamailio-6.0.1/debian/patches/upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,49 @@ +From: Victor Seva +Date: Mon, 4 May 2026 10:51:36 +0200 +Subject: ims_registrar_pcscf: Fix problems with double mem free + +fix #4671 + +same logic as 91c5ca751799db4f25a28a495350cc97f7c2f390 + +(cherry picked from commit 722c06b3efc53ccb369ce812c685c7d069508187) +(cherry picked from commit 66e0b5075dc741095bf3439e76d25833f8f82e52) +--- + src/modules/ims_registrar_pcscf/sec_agree.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/src/modules/ims_registrar_pcscf/sec_agree.c b/src/modules/ims_registrar_pcscf/sec_agree.c +index c65f45c..3b24467 100644 +--- a/src/modules/ims_registrar_pcscf/sec_agree.c ++++ b/src/modules/ims_registrar_pcscf/sec_agree.c +@@ -217,14 +217,22 @@ cleanup: + shm_free(params->sec_header.s); + shm_free(params->data.ipsec); + if(params->type == SECURITY_IPSEC && params->data.ipsec) { +- shm_free(params->data.ipsec->ealg.s); +- shm_free(params->data.ipsec->r_ealg.s); +- shm_free(params->data.ipsec->ck.s); +- shm_free(params->data.ipsec->alg.s); +- shm_free(params->data.ipsec->r_alg.s); +- shm_free(params->data.ipsec->ik.s); +- shm_free(params->data.ipsec->prot.s); +- shm_free(params->data.ipsec->mod.s); ++ if(params->data.ipsec->ealg.s) ++ shm_free(params->data.ipsec->ealg.s); ++ if(params->data.ipsec->r_ealg.s) ++ shm_free(params->data.ipsec->r_ealg.s); ++ if(params->data.ipsec->ck.s) ++ shm_free(params->data.ipsec->ck.s); ++ if(params->data.ipsec->alg.s) ++ shm_free(params->data.ipsec->alg.s); ++ if(params->data.ipsec->r_alg.s) ++ shm_free(params->data.ipsec->r_alg.s); ++ if(params->data.ipsec->ik.s) ++ shm_free(params->data.ipsec->ik.s); ++ if(params->data.ipsec->prot.s) ++ shm_free(params->data.ipsec->prot.s); ++ if(params->data.ipsec->mod.s) ++ shm_free(params->data.ipsec->mod.s); + shm_free(params->data.ipsec); + } + diff -Nru kamailio-6.0.1/debian/patches/upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre2.patch kamailio-6.0.1/debian/patches/upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre2.patch --- kamailio-6.0.1/debian/patches/upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre2.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre2.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,30 @@ +From: Victor Seva +Date: Mon, 4 May 2026 11:08:26 +0200 +Subject: ims_registrar_pcscf: Fix problems with double mem free, take two + +* include sec_header check +* don't free data.ipsec before + +related #4671 + +(cherry picked from commit 824dc0d39bf067ba343d7503b218e131a1944eea) +(cherry picked from commit 72e19957e2097b5a96ef50437dde9fae75077a63) +--- + src/modules/ims_registrar_pcscf/sec_agree.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/modules/ims_registrar_pcscf/sec_agree.c b/src/modules/ims_registrar_pcscf/sec_agree.c +index 3b24467..2cd0567 100644 +--- a/src/modules/ims_registrar_pcscf/sec_agree.c ++++ b/src/modules/ims_registrar_pcscf/sec_agree.c +@@ -214,8 +214,8 @@ cleanup: + // Function - free_security() + // Keep them in sync! + if(params) { +- shm_free(params->sec_header.s); +- shm_free(params->data.ipsec); ++ if(params->sec_header.s) ++ shm_free(params->sec_header.s); + if(params->type == SECURITY_IPSEC && params->data.ipsec) { + if(params->data.ipsec->ealg.s) + shm_free(params->data.ipsec->ealg.s); diff -Nru kamailio-6.0.1/debian/patches/upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre3.patch kamailio-6.0.1/debian/patches/upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre3.patch --- kamailio-6.0.1/debian/patches/upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre3.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/ims_registrar_pcscf-Fix-problems-with-double-mem-fre3.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,27 @@ +From: Victor Seva +Date: Mon, 4 May 2026 11:43:06 +0200 +Subject: ims_registrar_pcscf: Fix problems with double mem free, take three + +related #4671 + +* free params->data.ipsec always + +(cherry picked from commit 5f6dd0bb09fa33a07397902f9822fb5c1a370945) +(cherry picked from commit bb74017208cdefdbc397d8b2474b73bde70e29f9) +--- + src/modules/ims_registrar_pcscf/sec_agree.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/src/modules/ims_registrar_pcscf/sec_agree.c b/src/modules/ims_registrar_pcscf/sec_agree.c +index 2cd0567..f7894dd 100644 +--- a/src/modules/ims_registrar_pcscf/sec_agree.c ++++ b/src/modules/ims_registrar_pcscf/sec_agree.c +@@ -234,6 +234,8 @@ cleanup: + if(params->data.ipsec->mod.s) + shm_free(params->data.ipsec->mod.s); + shm_free(params->data.ipsec); ++ } else { ++ shm_free(params->data.ipsec); + } + + shm_free(params); diff -Nru kamailio-6.0.1/debian/patches/upstream/ims_registrar_pcscf-free-previous-sec-agree-value-at.patch kamailio-6.0.1/debian/patches/upstream/ims_registrar_pcscf-free-previous-sec-agree-value-at.patch --- kamailio-6.0.1/debian/patches/upstream/ims_registrar_pcscf-free-previous-sec-agree-value-at.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/ims_registrar_pcscf-free-previous-sec-agree-value-at.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,34 @@ +From: Victor Seva +Date: Tue, 28 Jul 2026 19:04:42 +0200 +Subject: ims_registrar_pcscf: free previous sec-agree value at + process_sec_agree_param() + +process_sec_agree_param() can be called several times for the same parameter +in this case we will leak the mem for the previous value. + +Based on solution from qasimomneia at #4841 + +(cherry picked from commit 11351f70892e0c6a1fc221b6b4cd503da60a07c4) +(cherry picked from commit f5d29d10cd0ad432cb0e5acb1959daf805592a5e) +--- + src/modules/ims_registrar_pcscf/sec_agree.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/modules/ims_registrar_pcscf/sec_agree.c b/src/modules/ims_registrar_pcscf/sec_agree.c +index f7894dd..de00b9e 100644 +--- a/src/modules/ims_registrar_pcscf/sec_agree.c ++++ b/src/modules/ims_registrar_pcscf/sec_agree.c +@@ -68,9 +68,13 @@ static void trim_whitespaces(str *string) + } + + #define SEC_COPY_STR_PARAM(DST, SRC) \ ++ if(DST.s != NULL) { \ ++ shm_free(DST.s); \ ++ } \ + DST.s = shm_malloc(SRC.len); \ + if(DST.s == NULL) { \ + SHM_MEM_ERROR; \ ++ DST.len = 0; \ + return -1; \ + } \ + memcpy(DST.s, SRC.s, SRC.len); \ diff -Nru kamailio-6.0.1/debian/patches/upstream/ims_registrar_scscf-check-len-before-get_4bytes.patch kamailio-6.0.1/debian/patches/upstream/ims_registrar_scscf-check-len-before-get_4bytes.patch --- kamailio-6.0.1/debian/patches/upstream/ims_registrar_scscf-check-len-before-get_4bytes.patch 1970-01-01 00:00:00.000000000 +0000 +++ kamailio-6.0.1/debian/patches/upstream/ims_registrar_scscf-check-len-before-get_4bytes.patch 2026-09-08 21:48:12.000000000 +0000 @@ -0,0 +1,69 @@ +From: Victor Seva +Date: Tue, 14 Jul 2026 12:50:17 +0200 +Subject: ims_registrar_scscf: check len before get_4bytes() + +(cherry picked from commit abb5d60af6eefbd367bf6588c5589566b090e272) +(cherry picked from commit 062702b948f4264622a341ea9216c0d2cb380385) +--- + src/modules/ims_registrar_scscf/cxdx_avp.c | 27 ++++++++++++++++++--------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +diff --git a/src/modules/ims_registrar_scscf/cxdx_avp.c b/src/modules/ims_registrar_scscf/cxdx_avp.c +index 9924808..a01e13e 100644 +--- a/src/modules/ims_registrar_scscf/cxdx_avp.c ++++ b/src/modules/ims_registrar_scscf/cxdx_avp.c +@@ -301,7 +301,7 @@ int cxdx_get_result_code(AAAMessage *msg, int *data) + { + str s; + s = cxdx_get_avp(msg, AVP_Result_Code, 0, __FUNCTION__); +- if(!s.s) ++ if(!s.s || s.len < 4) + return 0; + *data = get_4bytes(s.s); + return 1; +@@ -325,7 +325,7 @@ int cxdx_get_experimental_result_code(AAAMessage *msg, int *data) + + avp = cdpb.AAAFindMatchingAVPList( + list, 0, AVP_IMS_Experimental_Result_Code, 0, 0); +- if(!avp || !avp->data.s) { ++ if(!avp || !avp->data.s || avp->data.len < 4) { + cdpb.AAAFreeAVPList(&list); + return 0; + } +@@ -403,12 +403,21 @@ int cxdx_get_capabilities(AAAMessage *msg, int **m, int *m_cnt, int **o, + *o_cnt = 0; + *p_cnt = 0; + while(avp) { +- if(avp->code == AVP_IMS_Mandatory_Capability) +- (*m)[(*m_cnt)++] = get_4bytes(avp->data.s); +- if(avp->code == AVP_IMS_Optional_Capability) +- (*o)[(*o_cnt)++] = get_4bytes(avp->data.s); +- if(avp->code == AVP_IMS_Server_Name) +- (*p)[(*p_cnt)++] = avp->data; ++ switch(avp->code) { ++ case AVP_IMS_Mandatory_Capability: ++ if(!avp->data.s || avp->data.len < 4) ++ break; ++ (*m)[(*m_cnt)++] = get_4bytes(avp->data.s); ++ break; ++ case AVP_IMS_Optional_Capability: ++ if(!avp->data.s || avp->data.len < 4) ++ break; ++ (*o)[(*o_cnt)++] = get_4bytes(avp->data.s); ++ break; ++ case AVP_IMS_Server_Name: ++ (*p)[(*p_cnt)++] = avp->data; ++ break; ++ } + avp = avp->next; + } + cdpb.AAAFreeAVPList(&list); +@@ -535,7 +544,7 @@ int cxdx_get_sip_number_auth_items(AAAMessage *msg, int *data) + str s; + s = cxdx_get_avp(msg, AVP_IMS_SIP_Number_Auth_Items, IMS_vendor_id_3GPP, + __FUNCTION__); +- if(!s.s) ++ if(!s.s || s.len < 4) + return 0; + *data = get_4bytes(s.s); + return 1;