From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933404AbcA0Oua (ORCPT ); Wed, 27 Jan 2016 09:50:30 -0500 Received: from smtp15.cstnet.cn ([159.226.251.15]:56259 "EHLO cstnet.cn" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S932725AbcA0Ou2 (ORCPT ); Wed, 27 Jan 2016 09:50:28 -0500 X-Greylist: delayed 506 seconds by postgrey-1.27 at vger.kernel.org; Wed, 27 Jan 2016 09:50:27 EST From: Zhouyi Zhou To: , , , , , , , Cc: Zhouyi Zhou , Zhouyi Zhou Subject: [PATCH 1/1] netfilter: h323: avoid potential attack Date: Wed, 27 Jan 2016 22:40:45 +0800 Message-Id: <1453905646-6446-1-git-send-email-zhouzhouyi@gmail.com> X-Mailer: git-send-email 1.7.10.4 X-CM-TRANSID: UgCowJDLounj1qhWGSAJBA--.20303S3 X-Coremail-Antispam: 1UD129KBjvJXoW7Zr4furWUXFWrtrW7GF4DJwb_yoW8XF15pF nYk34xtw17JF1jva1UKw4jkw1qvrZ3J3W2gas8ZasYk3W3Jrs8uayDKFyjqFWFqrs3GrW7 ArWYqa47GF4kJF7anT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUgEb7Iv0xC_tr1lb4IE77IF4wAFF20E14v26r4j6ryUM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rw A2z4x0Y4vE2Ix0cI8IcVAFwI0_Gr0_Xr1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_ Cr1l84ACjcxK6I8E87Iv67AKxVW0oVCq3wA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_GcCE3s 1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrVC2j2WlYx0E2Ix0 cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkEbVWUJVW8Jw ACjcxG0xvY0x0EwIxGrwACjcxG0xvY0x0EwIxGrVCF72vEw4AK0wACI402YVCY1x02628v n2kIc2xKxwCF04k20xvY0x0EwIxGrwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4 vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw0_GFylIxAIcVC0I7IYx2IY67AKxVWUJVWU CwCI42IY6xIIjxv20xvEc7CjxVAFwI0_Jr0_Gr1lIxAIcVCF04k26cxKx2IYs7xG6rW3Jr 0E3s1lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVWUJVW8JbIY CTnIWIevJa73UjIFyTuYvj4RJUUUUUUUU X-CM-SenderInfo: p2kr365krx5x46jptx3oof0z/ Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Zhouyi Zhou I think hackers chould build a malicious h323 packet to overflow the pointer p which will panic during the memcpy(addr, p, len) For example, he may fabricate a very large taddr->ipAddress.ip; Signed-off-by: Zhouyi Zhou --- net/netfilter/nf_conntrack_h323_main.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c index 9511af0..3b3dd8c 100644 --- a/net/netfilter/nf_conntrack_h323_main.c +++ b/net/netfilter/nf_conntrack_h323_main.c @@ -110,6 +110,10 @@ int (*nat_q931_hook) (struct sk_buff *skb, static DEFINE_SPINLOCK(nf_h323_lock); static char *h323_buffer; +#define CHECK_BOUND(p, n) do { \ + if (((p - h323_buffer) + n) > 65536) \ + return 0; \ +} while (0) static struct nf_conntrack_helper nf_conntrack_helper_h245; static struct nf_conntrack_helper nf_conntrack_helper_q931[]; @@ -247,6 +251,8 @@ static int get_h245_addr(struct nf_conn *ct, const unsigned char *data, return 0; } + CHECK_BOUND(p, len); + memcpy(addr, p, len); memset((void *)addr + len, 0, sizeof(*addr) - len); memcpy(port, p + len, sizeof(__be16)); @@ -669,6 +675,8 @@ int get_h225_addr(struct nf_conn *ct, unsigned char *data, return 0; } + CHECK_BOUND(p, len); + memcpy(addr, p, len); memset((void *)addr + len, 0, sizeof(*addr) - len); memcpy(port, p + len, sizeof(__be16)); -- 1.7.10.4