From patchwork Sat Apr 23 17:08:33 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Toby DiPasquale X-Patchwork-Id: 614069 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3qsf8P2vb6z9t3h for ; Sun, 24 Apr 2016 03:08:37 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=cbcg-net.20150623.gappssmtp.com header.i=@cbcg-net.20150623.gappssmtp.com header.b=CtcuiY4/; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752050AbcDWRIf (ORCPT ); Sat, 23 Apr 2016 13:08:35 -0400 Received: from mail-yw0-f172.google.com ([209.85.161.172]:33059 "EHLO mail-yw0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751945AbcDWRIe (ORCPT ); Sat, 23 Apr 2016 13:08:34 -0400 Received: by mail-yw0-f172.google.com with SMTP id t10so152543176ywa.0 for ; Sat, 23 Apr 2016 10:08:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cbcg-net.20150623.gappssmtp.com; s=20150623; h=mime-version:date:message-id:subject:from:to; bh=UGkNZbL6AwuQIBFXWFJi6yOcwp1aDa7ocyxajhBHvnA=; b=CtcuiY4/wSJSB+LOO/9ELv+2OvzdwyUXqOkvNVbOnwisbCt1yW3UenfBoyyE+sAddg 2Y82SjQlnosDMgVS5wDIIz5kVRpfraRaXOH8YvjYnrs1zbKn7+PIHqDOKUlBbLzrGQup BY+Hrr/ZBleaRxGZ9Si4ypWYWN+YiuklYe5e61I/pHqIRCYbCeUemoEkKCinLPAAT3VV Tc+yy6GqXIJBMi4G9aqVtjKDk/TsxhF9g04dPwgn8nqu8Sz5lyAysCAP1yibvGVq84Ya mj6nVMBFh8wcSHXbm2+wvl5ar0E/MOGDEkDDrPZ3V+9oHTLwjLxMEjzl622OsL6B5uPc gWyw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to; bh=UGkNZbL6AwuQIBFXWFJi6yOcwp1aDa7ocyxajhBHvnA=; b=EGT+SkiKbVBZJ/EQeqN3+R3Kc5OtX7NdFzV9+H8HmUsrFVjs8nSy66uQ4y9QOPgmQk 7GBNIT1zFBnBtVg3Av/zupOrBw9QaKaDgRcUfr+752U2hy99CeL2e4teWA/DL1ubuZaT yaD8D7PcFD9q9TZLUB/TnnWGWNhLtg0EZpHqfk8cuRj71/O04rBLGBk+POa6yRYJOqO9 r4lxHZNzVLkP5I8HL6Lq2qnYqm7Y+cvsE2hwYMM76zISLmU1AskPnS2DTZPEWfu76y46 3uNiqE0n2xHFsMtt0g5YfiJxAHfZ+eVX5t2kqO4JpIZtRVUpCV5KkuAHtvjc7nQDJ1jJ K5Nw== X-Gm-Message-State: AOPr4FX3K1WsMpOSjEY1J7CX8MW1VhLR6h08f+QwQKkVJ64937lLAFdDPSpTK6EQ9EWo8ANaecnds4cUThXBQg== MIME-Version: 1.0 X-Received: by 10.13.253.1 with SMTP id n1mr17884871ywf.83.1461431313632; Sat, 23 Apr 2016 10:08:33 -0700 (PDT) Received: by 10.13.206.133 with HTTP; Sat, 23 Apr 2016 10:08:33 -0700 (PDT) Date: Sat, 23 Apr 2016 13:08:33 -0400 Message-ID: Subject: [PATCH] off-by-one in DecodeQ931 From: Toby DiPasquale To: pablo@netfilter.org, Patrick McHardy , kadlec@blackhole.kfki.hu, davem@davemloft.net, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org I was reviewing the H.323 conntrack helper in the kernel when I came across what appears to be an off-by-one error in the DecodeQ931 function. The MessageType field of the Q931 record is assigned and p is incremented, but the corresponding decrement to sz is missing, leading the sz variable to be one more than it should be. This patch decrements sz so it is the proper value going into the parsing of the information elements. Signed-off-by: Toby DiPasquale diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c index bcd5ed6..68b1557 100644 --- a/net/netfilter/nf_conntrack_h323_asn1.c +++ b/net/netfilter/nf_conntrack_h323_asn1.c @@ -849,6 +849,7 @@ int DecodeQ931(unsigned char *buf, size_t sz, Q931 *q931) if (sz < 1) return H323_ERROR_BOUND; q931->MessageType = *p++; + sz--; PRINT("MessageType = %02X\n", q931->MessageType); if (*p & 0x80) { p++;