netfilter: h323: bug in parsing of ASN1 SEQOF field
authorDavid Sterba <dsterba@suse.cz>
Mon, 4 Apr 2011 13:21:02 +0000 (15:21 +0200)
committerBrad Figg <brad.figg@canonical.com>
Wed, 27 Apr 2011 18:41:29 +0000 (11:41 -0700)
commit9f28ed0114fe86f2ad2014472b968502d688c14f
treee5d6d939618b312f2ae1e5af36669e203eeb1fb6
parent5b67027b143216d6ee37ae5bf730cedcf2f9a719
netfilter: h323: bug in parsing of ASN1 SEQOF field

BugLink: http://bugs.launchpad.net/bugs/761134

commit b4232a22776aa5d063f890d21ca69870dbbe431b upstream.

Static analyzer of clang found a dead store which appears to be a bug in
reading count of items in SEQOF field, only the lower byte of word is
stored. This may lead to corrupted read and communication shutdown.

The bug has been in the module since it's first inclusion into linux
kernel.

[Patrick: the bug is real, but without practical consequence since the
 largest amount of sequence-of members we parse is 30.]

Signed-off-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
net/netfilter/nf_conntrack_h323_asn1.c