]> git-server-git.apps.pok.os.sepia.ceph.com Git - ceph-client.git/commitdiff
netfilter: nf_conntrack_h323: don't pass uninitialised l3num value
authorFlorian Westphal <fw@strlen.de>
Wed, 11 Feb 2026 11:53:09 +0000 (12:53 +0100)
committerFlorian Westphal <fw@strlen.de>
Tue, 17 Feb 2026 14:04:20 +0000 (15:04 +0100)
Mihail Milev reports: Error: UNINIT (CWE-457):
 net/netfilter/nf_conntrack_h323_main.c:1189:2: var_decl:
Declaring variable "tuple" without initializer.
 net/netfilter/nf_conntrack_h323_main.c:1197:2:
uninit_use_in_call: Using uninitialized value "tuple.src.l3num" when calling "__nf_ct_expect_find".
 net/netfilter/nf_conntrack_expect.c:142:2:
read_value: Reading value "tuple->src.l3num" when calling "nf_ct_expect_dst_hash".

  1195|    tuple.dst.protonum = IPPROTO_TCP;
  1196|
  1197|->  exp = __nf_ct_expect_find(net, nf_ct_zone(ct), &tuple);
  1198|    if (exp && exp->master == ct)
  1199|    return exp;

Switch this to a C99 initialiser and set the l3num value.

Fixes: f587de0e2feb ("[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port")
Signed-off-by: Florian Westphal <fw@strlen.de>
net/netfilter/nf_conntrack_h323_main.c

index 17f1f453d4813d0b562cf7ddeb6ce32ff396218c..a2a0e22ccee198ef2421b1f8ee03cbdd2f562612 100644 (file)
@@ -1187,13 +1187,13 @@ static struct nf_conntrack_expect *find_expect(struct nf_conn *ct,
 {
        struct net *net = nf_ct_net(ct);
        struct nf_conntrack_expect *exp;
-       struct nf_conntrack_tuple tuple;
+       struct nf_conntrack_tuple tuple = {
+               .src.l3num = nf_ct_l3num(ct),
+               .dst.protonum = IPPROTO_TCP,
+               .dst.u.tcp.port = port,
+       };
 
-       memset(&tuple.src.u3, 0, sizeof(tuple.src.u3));
-       tuple.src.u.tcp.port = 0;
        memcpy(&tuple.dst.u3, addr, sizeof(tuple.dst.u3));
-       tuple.dst.u.tcp.port = port;
-       tuple.dst.protonum = IPPROTO_TCP;
 
        exp = __nf_ct_expect_find(net, nf_ct_zone(ct), &tuple);
        if (exp && exp->master == ct)