lkml.org 
[lkml]   [2019]   [Jun]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.1 065/155] netfilter: nf_conntrack_h323: restore boundary check correctness
    Date
    [ Upstream commit f5e85ce8e733c2547827f6268136b70b802eabdb ]

    Since commit bc7d811ace4a ("netfilter: nf_ct_h323: Convert
    CHECK_BOUND macro to function"), NAT traversal for H.323
    doesn't work, failing to parse H323-UserInformation.
    nf_h323_error_boundary() compares contents of the bitstring,
    not the addresses, preventing valid H.323 packets from being
    conntrack'd.

    This looks like an oversight from when CHECK_BOUND macro was
    converted to a function.

    To fix it, stop dereferencing bs->cur and bs->end.

    Fixes: bc7d811ace4a ("netfilter: nf_ct_h323: Convert CHECK_BOUND macro to function")
    Signed-off-by: Jakub Jankowski <shasta@toxcorp.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/nf_conntrack_h323_asn1.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
    index 1601275efe2d..4c2ef42e189c 100644
    --- a/net/netfilter/nf_conntrack_h323_asn1.c
    +++ b/net/netfilter/nf_conntrack_h323_asn1.c
    @@ -172,7 +172,7 @@ static int nf_h323_error_boundary(struct bitstr *bs, size_t bytes, size_t bits)
    if (bits % BITS_PER_BYTE > 0)
    bytes++;

    - if (*bs->cur + bytes > *bs->end)
    + if (bs->cur + bytes > bs->end)
    return 1;

    return 0;
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-06-13 18:01    [W:5.962 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site