From: Patrick McHardy <kaber@trash.net>
Date: Tue, 25 Jul 2006 05:52:10 +0000 (-0700)
Subject: [NETFILTER]: H.323 helper: fix possible NULL-ptr dereference
X-Git-Tag: v2.6.18-rc3~30^2~13
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=083edca05ab1fa6efac1ba414018f7f45a4a83ff;p=linux-2.6

[NETFILTER]: H.323 helper: fix possible NULL-ptr dereference

An RCF message containing a timeout results in a NULL-ptr dereference if
no RRQ has been seen before.

Noticed by the "SATURN tool", reported by Thomas Dillig <tdillig@stanford.edu>
and Isil Dillig <isil@stanford.edu>.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323.c b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
index af35235672..9a39e29697 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
@@ -1200,7 +1200,7 @@ static struct ip_conntrack_expect *find_expect(struct ip_conntrack *ct,
 	tuple.dst.protonum = IPPROTO_TCP;
 
 	exp = __ip_conntrack_expect_find(&tuple);
-	if (exp->master == ct)
+	if (exp && exp->master == ct)
 		return exp;
 	return NULL;
 }