Re: [PATCH net 1/2] netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

[Florian Westphal <fw@strlen.de>]

Paolo Abeni <pabeni@redhat.com> wrote:
> On 2/26/26 10:10 AM, Florian Westphal wrote:
> > Florian Westphal <fw@strlen.de> wrote:
> >> From: Vahagn Vardanian <vahagn@redrays.io>
> >>
> >> In decode_choice(), the boundary check before get_len() uses the
> >> variable `len`, which is still 0 from its initialization at the top of
> >> the function:
> >>
> > 
> > @net maintainers: would you mind applying this patch directly?
> > 
> > I don't know when Pablo can re-spin his fix, and I don't want
> > to hold up the H323 patch.
> 
> Makes sense. Note that I'll apply the patch (as opposed to pull it),
> meaning it will get a new hash.

Yes, thats fine.

At the moment both nf and nf-next stictly follow net/net-next, i.e.
nf:main and nf-next:main might be behind the corresponding net
tree, but are never ahead.

Patches are queued up in :testing.  This allows me to rebase and
if necessary drop patches again.

Then, for pull request, last "good" testing branch gets tagged,
then that tag is used in the pull request.

After you pull changes, I re-sync the nf tree the net one and
push to main.