fix: a fixed-size heap buffer of conntrackinfo_memsi... in...

[orbisai0security]

Summary

Fix critical severity security issue in natflow_conntrack.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	natflow_conntrack.c:271

Description: A fixed-size heap buffer of CONNTRACKINFO_MEMSIZE bytes is allocated at natflow_conntrack.c:271. At lines 291-340, at least 10 sequential sprintf() calls accumulate formatted connection tracking data (IPv4/IPv6 addresses, ports, TCP state names, protocol fields) into this buffer without any bounds checking. If the cumulative formatted output exceeds CONNTRACKINFO_MEMSIZE, subsequent sprintf() calls write beyond the allocated heap region, corrupting adjacent kernel heap objects. IPv6 addresses alone can consume up to 39 characters each, and multiple fields per conntrack entry can easily exceed a typical fixed buffer size.

Changes

• natflow_conntrack.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.