Re: [PATCH] netfilter: conntrack_irc: fix port value truncation in parse_dcc()

[Florian Westphal]

Aamir Ahmed <elb12345@xxxxxxxxxxxxx> wrote:
> diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
> index 92360963757a..8321f12dbf15 100644
> --- a/net/netfilter/nf_conntrack_irc.c
> +++ b/net/netfilter/nf_conntrack_irc.c
> @@ -64,6 +64,7 @@ static int parse_dcc(char *data, const char *data_end, __be32 *ip,
>  		     u_int16_t *port, char **ad_beg_p, char **ad_end_p)
>  {
>  	char *tmp;
> +	unsigned long tmp_port;
>  
>  	/* at least 12: "AAAAAAAA P\1\n" */
>  	while (*data++ != ' ')
> @@ -88,7 +89,10 @@ static int parse_dcc(char *data, const char *data_end, __be32 *ip,
>  		data++;
>  	}
>  
> -	*port = simple_strtoul(data, &data, 10);
> +	tmp_port = simple_strtoul(data, &data, 10);
> +	if (tmp_port > 65535)
> +		return -1;

Your other patch also rejects port == 0.
Maybe also check and refuse for tmp_port < 1024 here.

This patch can be handled via nf-next, I think.