Commit c2b9b4fe authored by Toby DiPasquale's avatar Toby DiPasquale Committed by Pablo Neira Ayuso

netfilter: nf_conntrack_h323: fix off-by-one in DecodeQ931

This patch corrects an off-by-one error in the DecodeQ931 function in
the nf_conntrack_h323 module. This error could result in reading off
the end of a Q.931 frame.
Signed-off-by: default avatarToby DiPasquale <toby@cbcg.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent c080b460
...@@ -846,9 +846,10 @@ int DecodeQ931(unsigned char *buf, size_t sz, Q931 *q931) ...@@ -846,9 +846,10 @@ int DecodeQ931(unsigned char *buf, size_t sz, Q931 *q931)
sz -= len; sz -= len;
/* Message Type */ /* Message Type */
if (sz < 1) if (sz < 2)
return H323_ERROR_BOUND; return H323_ERROR_BOUND;
q931->MessageType = *p++; q931->MessageType = *p++;
sz--;
PRINT("MessageType = %02X\n", q931->MessageType); PRINT("MessageType = %02X\n", q931->MessageType);
if (*p & 0x80) { if (*p & 0x80) {
p++; p++;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment