Summary

OpenSIPS's IMC module copies attacker-influenced URI data into three fixed
256-byte stack buffers inside the TM completion callback
imc_inv_callback() without any bounds check. The May 2026 IMC
buffer-overflow remediation fixed the global-buffer reply paths but missed
this callback, so the overflow remains exploitable in 3.6.7 and trunk.

Details

The callback (modules/imc/imc_cmd.c:1187-1293) builds an " is not
registered." notice:

• body_buf[256]: memcpy(body_buf, member->uri.s+4, member->uri.len-4)
  then memcpy(+21) (lines 1244-1245) => writes member->uri.len-4+21
  bytes; overflows when member->uri.len > 239.
• from_uri_buf[256]: strncpy(from_uri_buf, room->uri.s, room->uri.len)
  (line 1253).
• to_uri_buf[256]: strncpy(to_uri_buf, inv_uri.s, inv_uri.len) (line
  1259).
  member->uri/inv_uri are "sip:"+invited_user+"@"+host, built from the
  attacker's #invite target by imc_handle_invite (line 376) via
  imc_add_member (imc_mng.c:289-344, no length cap). The invite path's only
  guard (line 476, >= IMC_BUF_SIZE = 1024) admits 240–986-byte URIs, which
  then overflow the 256-byte callback buffers.

PoC

1. MESSAGE ... "#create r1" (attacker becomes room OWNER,
   imc_cmd.c:207-209).
2. MESSAGE ... "#invite <~300 'A's>@unroutable.invalid".
3. The IMC invite-notification MESSAGE fails -> TM fires imc_inv_callback
   with ps->code>=300 -> memcpy/strncpy overflow the 256-byte stack
   buffers -> worker crash.
   Guard-page harness reproducing the exact arithmetic (attached imc_guard.c):
   ./imc_guard 240 and ./imc_guard 300 fault (exit 138) at the 256-byte
   boundary; ./imc_guard 200 does not — matching member->uri.len > 239.

Impact

Remote DoS of the OpenSIPS worker; attacker-controlled out-of-bounds stack
write means memory-corruption impact beyond DoS cannot be excluded. Trigger
requires the imc module loaded and SIP-reachable; room-owner privilege is
self-obtained via #create.