From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S967024AbcA1Jel (ORCPT ); Thu, 28 Jan 2016 04:34:41 -0500 Received: from smtp23.cstnet.cn ([159.226.251.23]:36267 "EHLO cstnet.cn" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S965313AbcA1Jei (ORCPT ); Thu, 28 Jan 2016 04:34:38 -0500 From: Zhouyi Zhou To: linux-kernel@vger.kernel.org Cc: Zhouyi Zhou , Zhouyi Zhou Subject: [PATCH V2] netfilter: h323: avoid potential attack Date: Thu, 28 Jan 2016 17:34:47 +0800 Message-Id: <1453973687-5048-1-git-send-email-zhouzhouyi@gmail.com> X-Mailer: git-send-email 1.7.10.4 X-CM-TRANSID: SQCowJCLj92B4KlWiL8nBA--.3374S3 X-Coremail-Antispam: 1UD129KBjvJXoW7Cw18ur4rAryruF4kXr18Xwb_yoW8XFW5pF sY934xtw47tr1jva1jka12krs0v393J3WxWa95AasYk3W5Jrsxua98KryjqFWFqrs5GrW2 yrWYqa47CF4kJF7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUylb7Iv0xC_Zr1lb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rw A2z4x0Y4vE2Ix0cI8IcVAFwI0_Gr0_Xr1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_ Cr1l84ACjcxK6I8E87Iv67AKxVWxJr0_GcWl84ACjcxK6I8E87Iv6xkF7I0E14v26F4UJV W0owAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0 I7IYx2IY67AKxVWUAVWUtwAv7VC2z280aVAFwI0_Gr0_Cr1lOx8S6xCaFVCjc4AY6r1j6r 4UM4x0Y48IcxkI7VAKI48JM4x0Y48IcxkI7VAKI48G6xCjnVAKz4kxMxkF7I0En4kS14v2 6r1q6r43MxkIecxEwVAFwVW8uwCF04k20xvY0x0EwIxGrwC20s026c02F40E14v26r1j6r 18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jrv_JF1lIxAIcVC0I7IY x2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7CjxVAFwI0_Jr0_Gr1lIxAIcVCF04k26c xKx2IYs7xG6rW3Jr0E3s1lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x02 67AKxVWUJVW8JbIYCTnIWIevJa73UjIFyTuYvj4RJUUUUUUUU X-CM-SenderInfo: p2kr365krx5x46jptx3oof0z/ Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Thanks Eric for your review and advice. I think hackers chould build a malicious h323 packet to overflow the pointer p which will panic during the memcpy(addr, p, len) For example, he may fabricate a very large taddr->ipAddress.ip; Signed-off-by: Zhouyi Zhou --- net/netfilter/nf_conntrack_h323_main.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c index 9511af0..ccd08c5 100644 --- a/net/netfilter/nf_conntrack_h323_main.c +++ b/net/netfilter/nf_conntrack_h323_main.c @@ -110,6 +110,7 @@ int (*nat_q931_hook) (struct sk_buff *skb, static DEFINE_SPINLOCK(nf_h323_lock); static char *h323_buffer; +#define CHECK_BOUND(p, n) ((void *)p + n - (void *)h323_buffer > 65536) static struct nf_conntrack_helper nf_conntrack_helper_h245; static struct nf_conntrack_helper nf_conntrack_helper_q931[]; @@ -247,6 +248,9 @@ static int get_h245_addr(struct nf_conn *ct, const unsigned char *data, return 0; } + if (CHECK_BOUND(p, len + sizeof(__be16))) + return 0; + memcpy(addr, p, len); memset((void *)addr + len, 0, sizeof(*addr) - len); memcpy(port, p + len, sizeof(__be16)); @@ -669,6 +673,9 @@ int get_h225_addr(struct nf_conn *ct, unsigned char *data, return 0; } + if (CHECK_BOUND(p, len + sizeof(__be16))) + return 0; + memcpy(addr, p, len); memset((void *)addr + len, 0, sizeof(*addr) - len); memcpy(port, p + len, sizeof(__be16)); -- 1.7.10.4