[PATCH] netfilter: conntrack_irc: fix port value truncation in parse_dcc()

[Aamir Ahmed]

parse_dcc() uses simple_strtoul() to parse the port number from DCC
commands, storing the result directly in a u16.  simple_strtoul()
returns unsigned long, so values above 65535 are silently truncated.
For example, a DCC command with port "65537" is parsed as port 1,
bypassing the dcc_port == 0 rejection check and creating a conntrack
expectation for an unintended port.

The nf_conntrack_ftp helper had the same class of defect and was fixed
by using a wider accumulator with a range check (get_port checks
tmp_port > 65535).  The ipvs ftp helper was similarly fixed in commit
e625a9477d12 ("ipvs: fix integer overflow in ftp helper port/address
parsing").  Apply the same pattern here: parse into an unsigned long,
reject values above 65535, and only then assign to the u16.

Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port")
Signed-off-by: Aamir Ahmed <elb12345@xxxxxxxxxxxxx>
---
 net/netfilter/nf_conntrack_irc.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 92360963757a..8321f12dbf15 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -64,6 +64,7 @@ static int parse_dcc(char *data, const char *data_end, __be32 *ip,
 		     u_int16_t *port, char **ad_beg_p, char **ad_end_p)
 {
 	char *tmp;
+	unsigned long tmp_port;
 
 	/* at least 12: "AAAAAAAA P\1\n" */
 	while (*data++ != ' ')
@@ -88,7 +89,10 @@ static int parse_dcc(char *data, const char *data_end, __be32 *ip,
 		data++;
 	}
 
-	*port = simple_strtoul(data, &data, 10);
+	tmp_port = simple_strtoul(data, &data, 10);
+	if (tmp_port > 65535)
+		return -1;
+	*port = tmp_port;
 	*ad_end_p = data;
 
 	return 0;
-- 
2.43.0