mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-15 23:25:07 +00:00
4228e2a989
When a Choice element contains an unsupported choice no error is returned and parsing continues normally, but the choice value is not set and contains data from the last parsed message. This may in turn lead to parsing of more stale data and following crashes. Fixes a crash triggered by testcase 0003243 from the PROTOS c07-h2250v4 testsuite following random other testcases: CPU: 0 EIP: 0060:[<c01a9554>] Not tainted VLI EFLAGS: 00210646 (2.6.17-rc2 #3) EIP is at memmove+0x19/0x22 eax: d7be0307 ebx: d7be0307 ecx: e841fcf9 edx: d7be0307 esi: bfffffff edi: bfffffff ebp: da5eb980 esp: c0347e2c ds: 007b es: 007b ss: 0068 Process events/0 (pid: 4, threadinfo=c0347000 task=dff86a90) Stack: <0>00000006 c0347ea6 d7be0301 e09a6b2c 00000006 da5eb980 d7be003e d7be0052 c0347f6c e09a6d9c 00000006 c0347ea6 00000006 00000000 d7b9a548 00000000 c0347f6c d7b9a548 00000004 e0a1a119 0000028f 00000006 c0347ea6 00000006 Call Trace: [<e09a6b2c>] mangle_contents+0x40/0xd8 [ip_nat] [<e09a6d9c>] ip_nat_mangle_tcp_packet+0xa1/0x191 [ip_nat] [<e0a1a119>] set_addr+0x60/0x14d [ip_nat_h323] [<e0ab6e66>] q931_help+0x2da/0x71a [ip_conntrack_h323] [<e0ab6e98>] q931_help+0x30c/0x71a [ip_conntrack_h323] [<e09af242>] ip_conntrack_help+0x22/0x2f [ip_conntrack] [<c022934a>] nf_iterate+0x2e/0x5f [<c025d357>] xfrm4_output_finish+0x0/0x39f [<c02294ce>] nf_hook_slow+0x42/0xb0 [<c025d357>] xfrm4_output_finish+0x0/0x39f [<c025d732>] xfrm4_output+0x3c/0x4e [<c025d357>] xfrm4_output_finish+0x0/0x39f [<c0230370>] ip_forward+0x1c2/0x1fa [<c022f417>] ip_rcv+0x388/0x3b5 [<c02188f9>] netif_receive_skb+0x2bc/0x2ec [<c0218994>] process_backlog+0x6b/0xd0 [<c021675a>] net_rx_action+0x4b/0xb7 [<c0115606>] __do_softirq+0x35/0x7d [<c0104294>] do_softirq+0x38/0x3f Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
|---|---|---|
| .. | ||
| arp_tables.c | ||
| arpt_mangle.c | ||
| arptable_filter.c | ||
| ip_conntrack_amanda.c | ||
| ip_conntrack_core.c | ||
| ip_conntrack_ftp.c | ||
| ip_conntrack_helper_h323.c | ||
| ip_conntrack_helper_h323_asn1.c | ||
| ip_conntrack_helper_h323_types.c | ||
| ip_conntrack_helper_pptp.c | ||
| ip_conntrack_irc.c | ||
| ip_conntrack_netbios_ns.c | ||
| ip_conntrack_netlink.c | ||
| ip_conntrack_proto_generic.c | ||
| ip_conntrack_proto_gre.c | ||
| ip_conntrack_proto_icmp.c | ||
| ip_conntrack_proto_sctp.c | ||
| ip_conntrack_proto_tcp.c | ||
| ip_conntrack_proto_udp.c | ||
| ip_conntrack_standalone.c | ||
| ip_conntrack_tftp.c | ||
| ip_nat_amanda.c | ||
| ip_nat_core.c | ||
| ip_nat_ftp.c | ||
| ip_nat_helper.c | ||
| ip_nat_helper_h323.c | ||
| ip_nat_helper_pptp.c | ||
| ip_nat_irc.c | ||
| ip_nat_proto_gre.c | ||
| ip_nat_proto_icmp.c | ||
| ip_nat_proto_tcp.c | ||
| ip_nat_proto_udp.c | ||
| ip_nat_proto_unknown.c | ||
| ip_nat_rule.c | ||
| ip_nat_snmp_basic.c | ||
| ip_nat_standalone.c | ||
| ip_nat_tftp.c | ||
| ip_queue.c | ||
| ip_tables.c | ||
| ipt_addrtype.c | ||
| ipt_ah.c | ||
| ipt_CLUSTERIP.c | ||
| ipt_DSCP.c | ||
| ipt_dscp.c | ||
| ipt_ECN.c | ||
| ipt_ecn.c | ||
| ipt_hashlimit.c | ||
| ipt_iprange.c | ||
| ipt_LOG.c | ||
| ipt_MASQUERADE.c | ||
| ipt_NETMAP.c | ||
| ipt_owner.c | ||
| ipt_recent.c | ||
| ipt_REDIRECT.c | ||
| ipt_REJECT.c | ||
| ipt_SAME.c | ||
| ipt_TCPMSS.c | ||
| ipt_TOS.c | ||
| ipt_tos.c | ||
| ipt_TTL.c | ||
| ipt_ttl.c | ||
| ipt_ULOG.c | ||
| iptable_filter.c | ||
| iptable_mangle.c | ||
| iptable_raw.c | ||
| Kconfig | ||
| Makefile | ||
| nf_conntrack_l3proto_ipv4.c | ||
| nf_conntrack_proto_icmp.c | ||