Unverified Commit c603db99 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!6521 netfilter: nf_conntrack_h323: Add protection for bmp length out of range 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yang Yingliang <yangyingliang@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/UQYUTPK4GNG4C3CTJU5ZQAUBXAXEWAZ5/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9HKAZ 
 
Link:https://gitee.com/openeuler/kernel/pulls/6521

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 3629ae98 3c3b8f13

net/netfilter/nf_conntrack_h323_asn1.c

+4 −0
Original line number Diff line number Diff line
@@ -536,6 +536,8 @@ static int decode_seq(struct bitstr *bs, const struct field_t *f, 
	/* Get fields bitmap */

	if (nf_h323_error_boundary(bs, 0, f->sz))

		return H323_ERROR_BOUND;

	if (f->sz > 32)

		return H323_ERROR_RANGE;

	bmp = get_bitmap(bs, f->sz);

	if (base)

		*(unsigned int *)base = bmp;
@@ -592,6 +594,8 @@ static int decode_seq(struct bitstr *bs, const struct field_t *f, 
	bmp2_len = get_bits(bs, 7) + 1;

	if (nf_h323_error_boundary(bs, 0, bmp2_len))

		return H323_ERROR_BOUND;

	if (bmp2_len > 32)

		return H323_ERROR_RANGE;

	bmp2 = get_bitmap(bs, bmp2_len);

	bmp |= bmp2 >> f->sz;

	if (base)