From: Jakub Kicinski <kuba@kernel.org>
To: Guanni Qu <qguanni@gmail.com>
Cc: Florian Westphal <fw@strlen.de>,
edumazet@google.com, pablo@netfilter.org, netdev@vger.kernel.org,
davem@davemloft.net, netfilter-devel@vger.kernel.org,
pabeni@redhat.com
Subject: Re: [net,06/11] netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
Date: Sat, 14 Mar 2026 18:23:48 -0700 [thread overview]
Message-ID: <20260314182348.492f2240@kernel.org> (raw)
In-Reply-To: <CAFzOa16enGosPApaXYmypkUb8JK=SMsvi2XMSrDP+DShm=GMLQ@mail.gmail.com>
On Sat, 14 Mar 2026 15:16:37 -0700 Guanni Qu wrote:
> Confirmed, the AI review is incorrect on all points.
>
> The UNCO, SEMI, BYTE, and default cases all advance bs->cur without
> a pre-read check, but each has nf_h323_error_boundary(bs, 0, 0)
> immediately after (lines 358, 410, 483, 512). The pointer can
> temporarily overshoot bs->end, but the check catches it before any
> subsequent dereference.
>
> The CONS case my patch fixes is different: get_uint(bs, len)
> dereferences *bs->cur++ inline (lines 258, 262, 266), it reads
> 1-4 bytes from memory before any post-advance boundary check can
> fire. That's the gap the patch closes.
Thanks for checking / sorry for the noise ;(
next prev parent reply other threads:[~2026-03-15 1:23 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-13 15:06 [PATCH net 00/11] netfilter: updates for net Florian Westphal
2026-03-13 15:06 ` [PATCH net 01/11] netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() Florian Westphal
2026-03-14 16:20 ` patchwork-bot+netdevbpf
2026-03-13 15:06 ` [PATCH net 02/11] netfilter: conntrack: add missing netlink policy validations Florian Westphal
2026-03-13 15:06 ` [PATCH net 03/11] netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() Florian Westphal
2026-03-13 15:06 ` [PATCH net 04/11] netfilter: revert nft_set_rbtree: validate open interval overlap Florian Westphal
2026-03-16 8:14 ` [PATCH net 04/11] netfilter: revert nft_set_rbtree: validate open interval overlap: manual merge Matthieu Baerts
2026-03-13 15:06 ` [PATCH net 05/11] netfilter: nf_flow_table_ip: reset mac header before vlan push Florian Westphal
2026-03-13 15:06 ` [PATCH net 06/11] netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case Florian Westphal
2026-03-14 16:12 ` [net,06/11] " Jakub Kicinski
2026-03-14 18:31 ` Florian Westphal
2026-03-14 22:16 ` Guanni Qu
2026-03-15 1:23 ` Jakub Kicinski [this message]
2026-03-13 15:06 ` [PATCH net 07/11] nf_tables: nft_dynset: fix possible stateful expression memleak in error path Florian Westphal
2026-03-13 15:06 ` [PATCH net 08/11] netfilter: nft_ct: drop pending enqueued packets on removal Florian Westphal
2026-03-13 15:06 ` [PATCH net 09/11] netfilter: xt_CT: drop pending enqueued packets on template removal Florian Westphal
2026-03-13 15:06 ` [PATCH net 10/11] netfilter: xt_time: use unsigned int for monthday bit shift Florian Westphal
2026-03-13 15:06 ` [PATCH net 11/11] netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260314182348.492f2240@kernel.org \
--to=kuba@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
--cc=qguanni@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.