diff options
Diffstat (limited to 'tags/2.6.18-12/30017_nf_conntrack_h323-bounds-checking.patch')
| -rw-r--r-- | tags/2.6.18-12/30017_nf_conntrack_h323-bounds-checking.patch | 42 |
1 files changed, 42 insertions, 0 deletions
diff --git a/tags/2.6.18-12/30017_nf_conntrack_h323-bounds-checking.patch b/tags/2.6.18-12/30017_nf_conntrack_h323-bounds-checking.patch new file mode 100644 index 0000000..1101b89 --- /dev/null +++ b/tags/2.6.18-12/30017_nf_conntrack_h323-bounds-checking.patch @@ -0,0 +1,42 @@ +From: Jing Min Zhao <zhaojingmin@vivecode.com> +Date: Fri, 6 Jul 2007 00:05:01 +0000 (-0700) +Subject: [NETFILTER]: nf_conntrack_h323: add checking of out-of-range on choices' index values +X-Git-Tag: v2.6.22~11^2~2 +X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=25845b5155b55cd77e42655ec24161ba3feffa47 + +[NETFILTER]: nf_conntrack_h323: add checking of out-of-range on choices' index values + +Choices' index values may be out of range while still encoded in the fixed +length bit-field. This bug may cause access to undefined types (NULL +pointers) and thus crashes (Reported by Zhongling Wen). + +This patch also adds checking of decode flag when decoding SEQUENCEs. + +Signed-off-by: Jing Min Zhao <zhaojingmin@vivecode.com> +Signed-off-by: Patrick McHardy <kaber@trash.net> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + +Backported to Debian's 2.6.18 by dann frazier <dannf@debian.org> + +diff -urpN linux-source-2.6.18.orig/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c linux-source-2.6.18/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c +--- linux-source-2.6.18.orig/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c 2006-09-19 21:42:06.000000000 -0600 ++++ linux-source-2.6.18/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c 2007-07-11 00:23:22.000000000 -0600 +@@ -518,7 +518,7 @@ int decode_seq(bitstr_t * bs, field_t * + CHECK_BOUND(bs, 2); + len = get_len(bs); + CHECK_BOUND(bs, len); +- if (!base) { ++ if (!base || !(son->attr & DECODE)) { + PRINT("%*.s%s\n", (level + 1) * TAB_SIZE, + " ", son->name); + bs->cur += len; +@@ -704,6 +704,8 @@ int decode_choice(bitstr_t * bs, field_t + } else { + ext = 0; + type = get_bits(bs, f->sz); ++ if (type >= f->lb) ++ return H323_ERROR_RANGE; + } + + /* Write Type */ |