Re: [PATCH net 1/2] netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

patchwork-bot+netdevbpf
2026-02-26T14:00:01Z

Hello:

This series was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Wed, 25 Feb 2026 14:06:18 +0100 you wrote:
> From: Vahagn Vardanian <vahagn@redrays.io>
>
> In decode_choice(), the boundary check before get_len() uses the
> variable `len`, which is still 0 from its initialization at the top of
> the function:
>
> unsigned int type, ext, len = 0;
> ...
> if (ext || (son->attr & OPEN)) {
> BYTE_ALIGN(bs);
> if (nf_h323_error_boundary(bs, len, 0)) /* len is 0 here */
> return H323_ERROR_BOUND;
> len = get_len(bs); /* OOB read */
>
> [...]

Here is the summary with links:
- [net,1/2] netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
https://git.kernel.org/netdev/net/c/baed0d9ba91d
- [net,2/2] netfilter: nf_tables: unconditionally bump set->nelems before insertion
(no matching commit)

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.