[PATCH 5/8] Check for ICMP_ID in icmp_nfattr_to_tuple

[PATCH 5/8] Check for ICMP_ID in icmp_nfattr_to_tuple

[Pablo Neira]

[-- Attachment #1: Type: text/plain, Size: 364 bytes --]

This patch fixes an userspace triggered oops. If there is no ICMP_ID
info the reference to attr will be NULL.

Signed-off-by: Krzysztof Piotr Oledzki <ole@ans.pl>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris

[-- Attachment #2: 04-icmp-id.patch --]
[-- Type: text/plain, Size: 640 bytes --]

This patch fixes an userspace triggered oops. If there is no ICMP_ID
info the reference to attr will be NULL.

Signed-off-by: Krzysztof Piotr Oledzki <ole@ans.pl>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

--- a/net/ipv4/netfilter/ip_conntrack_proto_icmp.c	2005-11-06 02:17:29.000000000 +0100
+++ b/net/ipv4/netfilter/ip_conntrack_proto_icmp.c	2005-11-06 02:18:45.000000000 +0100
@@ -296,7 +296,8 @@
 				struct ip_conntrack_tuple *tuple)
 {
 	if (!tb[CTA_PROTO_ICMP_TYPE-1]
-	    || !tb[CTA_PROTO_ICMP_CODE-1])
+	    || !tb[CTA_PROTO_ICMP_CODE-1]
+	    || !tb[CTA_PROTO_ICMP_ID-1])
 		return -1;
 
 	tuple->dst.u.icmp.type = 

Re: [PATCH 5/8] Check for ICMP_ID in icmp_nfattr_to_tuple

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 573 bytes --]

On Tue, Nov 08, 2005 at 02:44:39AM +0100, Pablo Neira wrote:
> This patch fixes an userspace triggered oops. If there is no ICMP_ID
> info the reference to attr will be NULL.

thanks, applied.


-- 
- Harald Welte <laforge@netfilter.org>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]