From: kaber@trash.net
To: davem@davemloft.net
Cc: netfilter-devel@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH 3/8] netfilter: h323: bug in parsing of ASN1 SEQOF field
Date: Tue, 5 Apr 2011 15:04:14 +0200 [thread overview]
Message-ID: <1302008659-21141-4-git-send-email-kaber@trash.net> (raw)
In-Reply-To: <1302008659-21141-1-git-send-email-kaber@trash.net>
From: David Sterba <dsterba@suse.cz>
Static analyzer of clang found a dead store which appears to be a bug in
reading count of items in SEQOF field, only the lower byte of word is
stored. This may lead to corrupted read and communication shutdown.
The bug has been in the module since it's first inclusion into linux
kernel.
[Patrick: the bug is real, but without practical consequence since the
largest amount of sequence-of members we parse is 30.]
Signed-off-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
net/netfilter/nf_conntrack_h323_asn1.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
index 8678823..bcd5ed6 100644
--- a/net/netfilter/nf_conntrack_h323_asn1.c
+++ b/net/netfilter/nf_conntrack_h323_asn1.c
@@ -631,7 +631,7 @@ static int decode_seqof(bitstr_t *bs, const struct field_t *f,
CHECK_BOUND(bs, 2);
count = *bs->cur++;
count <<= 8;
- count = *bs->cur++;
+ count += *bs->cur++;
break;
case SEMI:
BYTE_ALIGN(bs);
--
1.7.2.3
next prev parent reply other threads:[~2011-04-05 13:04 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-04-05 13:04 [PATCH 0/8] netfilter: netfilter fixes for 2.6.39-rc1 kaber
2011-04-05 13:04 ` [PATCH 1/8] netfilter: ipset: list:set timeout variant fixes kaber
2011-04-05 13:04 ` [PATCH 2/8] netfilter: ipset: references are protected by rwlock instead of mutex kaber
2011-04-05 13:04 ` kaber [this message]
2011-04-05 13:04 ` [PATCH 4/8] IPVS: fix NULL ptr dereference in ip_vs_ctl.c ip_vs_genl_dump_daemons() kaber
2011-04-05 13:04 ` [PATCH 5/8] netfilter: af_info: add network namespace parameter to route hook kaber
2011-04-05 13:04 ` [PATCH 6/8] netfilter: af_info: add 'strict' parameter to limit lookup to .oif kaber
2011-04-05 13:04 ` [PATCH 7/8] netfilter: xt_addrtype: replace rt6_lookup with nf_afinfo->route kaber
2011-04-05 13:04 ` [PATCH 8/8] netfilter: xt_conntrack: fix inverted conntrack direction test kaber
2011-04-06 19:32 ` [PATCH 0/8] netfilter: netfilter fixes for 2.6.39-rc1 David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1302008659-21141-4-git-send-email-kaber@trash.net \
--to=kaber@trash.net \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).