Linux 2.6.20.15

Linux 2.6.20.15

[Greg KH]

We (the -stable team) are announcing the release of the 2.6.20.15 kernel.
This has a fix for a security problem with netfilter messages.  Any
2.6.20 user using netfilter is strongly urged to upgrade.

I'll also be replying to this message with a copy of the patch between
2.6.20.14 and 2.6.20.15

The updated 2.6.20.y git tree can be found at:
        git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.20.y.git
and can be browsed at the normal kernel.org git web browser:
        http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.20.y.git;a=summary

thanks,

greg k-h

---------

 Makefile                               |    2 +-
 net/netfilter/nf_conntrack_h323_asn1.c |    4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)


Summary of changes from v2.6.20.14 to v2.6.20.15
================================================

Greg Kroah-Hartman (1):
      Linux 2.6.20.15

Jing Min Zhao (1):
      nf_conntrack_h323: add checking of out-of-range on choices' index values

Re: Linux 2.6.20.15

[Greg KH]

diff --git a/Makefile b/Makefile
index 710c004..947ff3c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 20
-EXTRAVERSION = .14
+EXTRAVERSION = .15
 NAME = Homicidal Dwarf Hamster
 
 # *DOCUMENTATION*
diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
index f6fad71..6b7eaa0 100644
--- a/net/netfilter/nf_conntrack_h323_asn1.c
+++ b/net/netfilter/nf_conntrack_h323_asn1.c
@@ -518,7 +518,7 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
 			CHECK_BOUND(bs, 2);
 			len = get_len(bs);
 			CHECK_BOUND(bs, len);
-			if (!base) {
+			if (!base || !(son->attr & DECODE)) {
 				PRINT("%*.s%s\n", (level + 1) * TAB_SIZE,
 				      " ", son->name);
 				bs->cur += len;
@@ -704,6 +704,8 @@ int decode_choice(bitstr_t * bs, field_t * f, char *base, int level)
 	} else {
 		ext = 0;
 		type = get_bits(bs, f->sz);
+		if (type >= f->lb)
+			return H323_ERROR_RANGE;
 	}
 
 	/* Write Type */