You have to indicate what tree this is targetted to, [PATCH] itself
goes to /dev/null. Please use [PATCH ipvs] instead.
On Thu, Aug 13, 2026 at 01:59:30PM -0300, Joas Antonio wrote:
> ip_vs_ftp_get_addrport() accumulates decimal digits into a __u16
> (hport) and into unsigned char (p[]) without checking for overflow.
> A crafted FTP PASV/EPSV response with an over-long port or address
> octet wraps the value, so the helper configures the data connection
> with a truncated port/address.
>
> The netfilter conntrack FTP helper had the same defect, fixed in
> commit 2b413fc689ba ("netfilter: nf_conntrack_ftp: avoid u16
> overflows"). Apply the equivalent fix here: widen the port accumulator
> to u32 and reject values above 65535, and reject address octets above
> 255.
Patch is garbled, mangled by MUA.
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: CyberSecurityUP <[email protected]>
Use a real name in your Signed-off-by.
> ---
> net/netfilter/ipvs/ip_vs_ftp.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
> index b315c608f..9e3e005a8 100644
> --- a/net/netfilter/ipvs/ip_vs_ftp.c
> +++ b/net/netfilter/ipvs/ip_vs_ftp.c
> @@ -102,7 +102,7 @@ static int ip_vs_ftp_get_addrport(char *data, char
> *data_limit,
> char *s, c;
> unsigned char p[6];
> char edelim;
> - __u16 hport;
> + __u32 hport;
> int i = 0;
>
> if (data_limit - data < plen) {
> @@ -144,7 +144,11 @@ static int ip_vs_ftp_get_addrport(char *data,
> char *data_limit,
> return -1;
> c = *data;
> if (isdigit(c)) {
> - p[i] = p[i]*10 + c - '0';
> + unsigned int val = p[i] * 10 + c - '0';
> +
> + if (val > 255)
> + return -1;
> + p[i] = val;
> } else if (c == ',' && i < 5) {
> i++;
> p[i] = 0;
> @@ -222,6 +226,8 @@ static int ip_vs_ftp_get_addrport(char *data, char
> *data_limit,
> if (!isdigit(*s))
> break;
> hport = hport * 10 + *s - '0';
> + if (hport > 65535)
> + return -1;
> }
> if (s == data_limit || !hport || *s != edelim)
> return -1;
> --
> 2.39.5 (Apple Git-154)
