parse_dcc() uses simple_strtoul() to parse the port number from DCC commands, storing the result directly in a u16. simple_strtoul() returns unsigned long, so values above 65535 are silently truncated. For example, a DCC command with port "65537" is parsed as port 1, bypassing the dcc_port == 0 rejection check and creating a conntrack expectation for an unintended port. The nf_conntrack_ftp helper had the same class of defect and was fixed by using a wider accumulator with a range check (get_port checks tmp_port > 65535). The ipvs ftp helper was similarly fixed in commit e625a9477d12 ("ipvs: fix integer overflow in ftp helper port/address parsing"). Apply the same pattern here: parse into an unsigned long, reject values above 65535, and only then assign to the u16. Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port") Signed-off-by: Aamir Ahmed --- net/netfilter/nf_conntrack_irc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c index 92360963757a..8321f12dbf15 100644 --- a/net/netfilter/nf_conntrack_irc.c +++ b/net/netfilter/nf_conntrack_irc.c @@ -64,6 +64,7 @@ static int parse_dcc(char *data, const char *data_end, __be32 *ip, u_int16_t *port, char **ad_beg_p, char **ad_end_p) { char *tmp; + unsigned long tmp_port; /* at least 12: "AAAAAAAA P\1\n" */ while (*data++ != ' ') @@ -88,7 +89,10 @@ static int parse_dcc(char *data, const char *data_end, __be32 *ip, data++; } - *port = simple_strtoul(data, &data, 10); + tmp_port = simple_strtoul(data, &data, 10); + if (tmp_port > 65535) + return -1; + *port = tmp_port; *ad_end_p = data; return 0; -- 2.43.0