Re: [PATCH net 1/2] netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

Florian Westphal
2026-02-26T09:10:49Z

Florian Westphal <fw@strlen.de> wrote:
> From: Vahagn Vardanian <vahagn@redrays.io>
>
> In decode_choice(), the boundary check before get_len() uses the
> variable `len`, which is still 0 from its initialization at the top of
> the function:
>

@net maintainers: would you mind applying this patch directly?

I don't know when Pablo can re-spin his fix, and I don't want
to hold up the H323 patch.

It seems silly to send a v2 MR with only one change.

Thanks!