Re: [PATCH] netfilter: nf_conntrack_h323: fix OOB read in get_bitmap()
Pablo Neira Ayuso <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.netfilter.devel |
|---|---|
| Message-ID | <an3Rz-1v5OwV8myG@chamomile> |
On Thu, Aug 13, 2026 at 11:10:54AM -0300, Joas Antonio wrote:
> --- a/net/netfilter/nf_conntrack_h323_asn1.c
> +++ b/net/netfilter/nf_conntrack_h323_asn1.c
> @@ -228,7 +228,8 @@ static unsigned int get_bitmap(struct bitstr *bs,
> unsigned int b)
> v |= (unsigned int)(*bs->cur++) << shift;
>
> if (l < 32) {
> - v |= (unsigned int)(*bs->cur) << shift;
> + if (l & 7)
> + v |= (unsigned int)(*bs->cur) << shift;
> v <<= bs->bit;
> } else if (l > 32) {
> v <<= bs->bit;
Dup:
https://patchwork.ozlabs.org/project/netfilter-devel/patch/[email protected]/