Thanks for your advices. I will take your advice if I could have the opportunity to write the final code.
As matter of factor, I trigger this bug when I tried to migrate H323 code to other operating systems. This could trigger a panic because get_h2x5_addr functions is the first time we ever try to ask for potentially out of range data because of H323 style decodings (the value taddr->ipAddress.ip is decoded in the midway between calling skb_header_pointer and calling get_h2x5_addr) > -----Original Messages----- > From: "Florian Westphal" <f...@strlen.de> > Sent Time: Thursday, January 28, 2016 > To: "Zhouyi Zhou" <zhouzho...@gmail.com> > Cc: eric.duma...@gmail.com, pa...@netfilter.org, ka...@trash.net, > kad...@blackhole.kfki.hu, da...@davemloft.net, > netfilter-de...@vger.kernel.org, coret...@netfilter.org, > netdev@vger.kernel.org, linux-ker...@vger.kernel.or, "Zhouyi Zhou" > <yizhouz...@ict.ac.cn> > Subject: Re: [PATCH V2] netfilter: h323: avoid potential attack > > Zhouyi Zhou <zhouzho...@gmail.com> wrote: > > Thanks Eric for your review and advice. > > > > I think hackers chould build a malicious h323 packet to overflow > > the pointer p which will panic during the memcpy(addr, p, len) > > > > For example, he may fabricate a very large taddr->ipAddress.ip; > > Can you be more specific? > > h323_buffer is backend storage for skb_header_pointer, i.e. > this will error out early when we ask for more data than is available in > packet. > > I don't understand how this could overflow anything. > Even assuming 64k packet we'd still have enough room in h323_buffer > for an ipv6 address, no? (we skip the l3/l4 header when extracting > packet payload). >
