[PATCH] netfilter: nf_conntrack_h323: fix NULL deref in decode_seqof()

[Guanglei Zhu]

decode_seqof() loads son from f->fields and dereferences son->attr
in the item loop without a NULL check.  A number of SEQOF entries
in nf_conntrack_h323_types.c carry a NULL fields pointer, so a
crafted packet that makes one of these optional fields present with
a nonzero item count dereferences NULL in the loop.

Skip the decoding when fields is NULL.

Signed-off-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>
---
Verified on a KASAN kernel with a test module calling decode_seqof()
with a fields=NULL SEQOF entry and a nonzero item count: NULL deref
report at son->attr (read of size 2 at address 0x4).

 net/netfilter/nf_conntrack_h323_asn1.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
index 6830c9da3..0d07d0276 100644
--- a/net/netfilter/nf_conntrack_h323_asn1.c
+++ b/net/netfilter/nf_conntrack_h323_asn1.c
@@ -691,6 +691,8 @@ static int decode_seqof(struct bitstr *bs, const struct field_t *f,
 	}
 
 	/* Decode nested field */
+	if (!f->fields)
+		return H323_ERROR_NONE;
 	son = f->fields;
 	if (base)
 		base -= son->offset;
-- 
2.43.0