Commit 1e3a3593 authored by Jenny Guanni Qu's avatar Jenny Guanni Qu Committed by Florian Westphal
Browse files

netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case 



In decode_int(), the CONS case calls get_bits(bs, 2) to read a length
value, then calls get_uint(bs, len) without checking that len bytes
remain in the buffer. The existing boundary check only validates the
2 bits for get_bits(), not the subsequent 1-4 bytes that get_uint()
reads. This allows a malformed H.323/RAS packet to cause a 1-4 byte
slab-out-of-bounds read.

Add a boundary check for len bytes after get_bits() and before
get_uint().

Fixes: 5e35941d ("[NETFILTER]: Add H.323 conntrack/NAT helper")
Reported-by: default avatarKlaudia Kloc <klaudia@vidocsecurity.com>
Reported-by: default avatarDawid Moczadło <dawid@vidocsecurity.com>
Signed-off-by: default avatarJenny Guanni Qu <qguanni@gmail.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
parent a3aca98a

net/netfilter/nf_conntrack_h323_asn1.c

+2 −0
Original line number Diff line number Diff line
@@ -331,6 +331,8 @@ static int decode_int(struct bitstr *bs, const struct field_t *f, 
		if (nf_h323_error_boundary(bs, 0, 2))

			return H323_ERROR_BOUND;

		len = get_bits(bs, 2) + 1;

		if (nf_h323_error_boundary(bs, len, 0))

			return H323_ERROR_BOUND;

		BYTE_ALIGN(bs);

		if (base && (f->attr & DECODE)) {	/* timeToLive */

			unsigned int v = get_uint(bs, len) + f->lb;