Re: [PATCH] netfilter: nf_conntrack_h323: fix NULL deref in decode_seqof()

[Guanglei Zhu]

You are right, I could not find a reachable path either.

I re-checked all call sites that would invoke decode_seqof() without
a DECODE guard:

- decode_seq() root loop: every SEQOF entry with a NULL fields
  pointer sits outside the root window (index >= f->lb); the ones
  inside the root window carry STOP or OPEN.
- decode_seq() extension loop: entries without DECODE are skipped
  with bs->cur += len, decode_seqof() is never called for them.
- decode_choice() and the decode_seqof() item loop: no NULL-fields
  SEQOF entries among the options/items without STOP or OPEN either.

So f->fields can only be NULL when decode_seqof() is called from
outside the decoder, which is what my test module did.  The KASAN
report only demonstrates the in-function deref, not reachability
from a packet.

Please drop this patch.