Unverified Commit 53816a70 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!7456 netfilter: nf_conntrack_h323: Add protection for bmp length out of range 

Merge Pull Request from: @ci-robot 
 
PR sync from: Guo Mengqi <guomengqi3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/ACMZ4S7UL6UOL7LUR6FXZ5QZGYW5HEIO/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9HKAZ 
 
Link:https://gitee.com/openeuler/kernel/pulls/7456

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 2a665eba dbbef70c

net/netfilter/nf_conntrack_h323_asn1.c

+4 −0
Original line number Diff line number Diff line
@@ -533,6 +533,8 @@ static int decode_seq(struct bitstr *bs, const struct field_t *f, 
	/* Get fields bitmap */

	if (nf_h323_error_boundary(bs, 0, f->sz))

		return H323_ERROR_BOUND;

	if (f->sz > 32)

		return H323_ERROR_RANGE;

	bmp = get_bitmap(bs, f->sz);

	if (base)

		*(unsigned int *)base = bmp;
@@ -589,6 +591,8 @@ static int decode_seq(struct bitstr *bs, const struct field_t *f, 
	bmp2_len = get_bits(bs, 7) + 1;

	if (nf_h323_error_boundary(bs, 0, bmp2_len))

		return H323_ERROR_BOUND;

	if (bmp2_len > 32)

		return H323_ERROR_RANGE;

	bmp2 = get_bitmap(bs, bmp2_len);

	bmp |= bmp2 >> f->sz;

	if (base)