From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754914AbcA1NWs (ORCPT ); Thu, 28 Jan 2016 08:22:48 -0500 Received: from smtp20.cstnet.cn ([159.226.251.20]:50529 "EHLO cstnet.cn" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S933058AbcA1NWq (ORCPT ); Thu, 28 Jan 2016 08:22:46 -0500 X-Greylist: delayed 416 seconds by postgrey-1.27 at vger.kernel.org; Thu, 28 Jan 2016 08:22:44 EST Date: Thu, 28 Jan 2016 21:14:42 +0800 (GMT+08:00) From: "Zhouyi Zhou" To: "Eric Dumazet" Cc: "Zhouyi Zhou" , pablo@netfilter.org, kaber@trash.net, kadlec@blackhole.kfki.hu, davem@davemloft.net, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Message-ID: In-Reply-To: <1453985821.7627.17.camel@edumazet-glaptop2.roam.corp.google.com> References: <1453971597-4811-1-git-send-email-zhouzhouyi@gmail.com> <1453985821.7627.17.camel@edumazet-glaptop2.roam.corp.google.com> Subject: Re: Re: [PATCH V2] netfilter: h323: avoid potential attack MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Originating-IP: [114.111.166.69] X-Priority: 3 X-Mailer: Coremail Webmail Server Version XT2.1.11 dev build 20150107(58648.7033.6860) Copyright (c) 2002-2016 www.mailtech.cn cstnet X-SendMailWithSms: false X-CM-CTRLDATA: /6eLxGZvb3Rlcl90eHQ9MTQ0MDo2 X-CM-TRANSID: VwCowJD7n+tDFKpWWj9MAA--.16261W X-CM-SenderInfo: x1l2x05x2k03g6lf3hldfou0/1tbiBwYIAFQquqDvAQACsB X-Coremail-Antispam: 1Ur529EdanIXcx71UUUUU7IcSsGvfJ3iIAIbVAYjsxI4VWxJw CS07vEb4IE77IF4wCS07vE1I0E4x80FVAKz4kxMIAIbVAFxVCaYxvI4VCIwcAKzIAtYxBI daVFxhVjvjDU= Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Thanks Eric for replying > -----Original Messages----- > From: "Eric Dumazet" > Sent Time: Thursday, January 28, 2016 > To: "Zhouyi Zhou" > Cc: pablo@netfilter.org, kaber@trash.net, kadlec@blackhole.kfki.hu, davem@davemloft.net, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.or, "Zhouyi Zhou" > Subject: Re: [PATCH V2] netfilter: h323: avoid potential attack > > On Thu, 2016-01-28 at 16:59 +0800, Zhouyi Zhou wrote: > > Thanks Eric for your review and advice. > > > > I think hackers chould build a malicious h323 packet to overflow > > the pointer p which will panic during the memcpy(addr, p, len) > > > > For example, he may fabricate a very large taddr->ipAddress.ip; > > > > Signed-off-by: Zhouyi Zhou > > --- > > Except you did not address my feedback about potentially reading not > initialized memory. > > if the frame length was 1000 bytes, then surely accessing memory at > offset 8000 will either read garbage, or read data from a prior frame > and leak secrets. My patch is intend to prevent kernel panic, to prevent reading garbage or read data from a prior frame and leak secrets, the prototypes of the get_h2x5_addr functions and the functions that call get_h2x5_addr should be changed, should we do this? > > > Cheers Zhouyi