Commit 6fd73703 authored May 03, 2006 by Patrick McHardy Committed by David S. Miller May 03, 2006

[NETFILTER]: H.323 helper: fix endless loop caused by invalid TPKT len



When the TPKT len included in the packet is below the lowest valid value
of 4 an underflow occurs which results in an endless loop.

Found by testcase 0000058 from the PROTOS c07-h2250v4 testsuite.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent e17df688

net/ipv4/netfilter/ip_conntrack_helper_h323.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -162,6 +162,8 @@ static int get_tpkt_data(struct sk_buff *pskb, struct ip_conntrack ct,

		/* Validate TPKT length */
		tpktlen = tpkt[2] * 256 + tpkt[3];
		if (tpktlen < 4)
		goto clear_out;
		if (tpktlen > tcpdatalen) {
		if (tcpdatalen == 4) { /* Separate TPKT header */
		/* Netmeeting sends TPKT header and data separately */