From: Jing Min Zhao Date: Fri, 6 Jul 2007 00:05:01 +0000 (-0700) Subject: [NETFILTER]: nf_conntrack_h323: add checking of out-of-range on choices' index values X-Git-Tag: v2.6.22~11^2~2 X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=25845b5155b55cd77e42655ec24161ba3feffa47 [NETFILTER]: nf_conntrack_h323: add checking of out-of-range on choices' index values Choices' index values may be out of range while still encoded in the fixed length bit-field. This bug may cause access to undefined types (NULL pointers) and thus crashes (Reported by Zhongling Wen). This patch also adds checking of decode flag when decoding SEQUENCEs. Signed-off-by: Jing Min Zhao Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller --- Backported to Debian's 2.6.18 by dann frazier diff -urpN linux-source-2.6.18.orig/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c linux-source-2.6.18/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c --- linux-source-2.6.18.orig/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c 2006-09-19 21:42:06.000000000 -0600 +++ linux-source-2.6.18/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c 2007-07-11 00:23:22.000000000 -0600 @@ -518,7 +518,7 @@ int decode_seq(bitstr_t * bs, field_t * CHECK_BOUND(bs, 2); len = get_len(bs); CHECK_BOUND(bs, len); - if (!base) { + if (!base || !(son->attr & DECODE)) { PRINT("%*.s%s\n", (level + 1) * TAB_SIZE, " ", son->name); bs->cur += len; @@ -704,6 +704,8 @@ int decode_choice(bitstr_t * bs, field_t } else { ext = 0; type = get_bits(bs, f->sz); + if (type >= f->lb) + return H323_ERROR_RANGE; } /* Write Type */