Re: [PATCH net 1/2] netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

Paolo Abeni
2026-02-26T11:47:45Z

On 2/26/26 10:10 AM, Florian Westphal wrote:
> Florian Westphal <fw@strlen.de> wrote:
>> From: Vahagn Vardanian <vahagn@redrays.io>
>>
>> In decode_choice(), the boundary check before get_len() uses the
>> variable `len`, which is still 0 from its initialization at the top of
>> the function:
>>
>
> @net maintainers: would you mind applying this patch directly?
>
> I don't know when Pablo can re-spin his fix, and I don't want
> to hold up the H323 patch.

Makes sense. Note that I'll apply the patch (as opposed to pull it),
meaning it will get a new hash.

Please scream very loudly, very soon if you prefer otherwise!

/P