Home Explore Help
Register Sign In
phyus
/
linux-vybrid_public
8
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Browse Source

[NETFILTER]: Fix potential memory corruption in NAT code (aka memory NAT)

The portptr pointing to the port in the conntrack tuple is declared static,
which could result in memory corruption when two packets of the same
protocol are NATed at the same time and one conntrack goes away.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Patrick McHardy 20 years ago
parent
4c1217deeb
commit
d04b4f8c1c
2 changed files with 4 additions and 2 deletions
Split View Show Diff Stats
  1. 2 1
      net/ipv4/netfilter/ip_nat_proto_tcp.c
  2. 2 1
      net/ipv4/netfilter/ip_nat_proto_udp.c

+ 2 - 1
net/ipv4/netfilter/ip_nat_proto_tcp.c
View File 

@@ -40,7 +40,8 @@ tcp_unique_tuple(struct ip_conntrack_tuple *tuple,
 
 		 enum ip_nat_manip_type maniptype,
 
 		 const struct ip_conntrack *conntrack)
 
 {
 
-	static u_int16_t port, *portptr;
 
+	static u_int16_t port;
 
+	u_int16_t *portptr;
 
 	unsigned int range_size, min, i;
 
 
 	if (maniptype == IP_NAT_MANIP_SRC)

+ 2 - 1
net/ipv4/netfilter/ip_nat_proto_udp.c
View File 

@@ -41,7 +41,8 @@ udp_unique_tuple(struct ip_conntrack_tuple *tuple,
 
 		 enum ip_nat_manip_type maniptype,
 
 		 const struct ip_conntrack *conntrack)
 
 {
 
-	static u_int16_t port, *portptr;
 
+	static u_int16_t port;
 
+	u_int16_t *portptr;
 
 	unsigned int range_size, min, i;
 
 
 	if (maniptype == IP_NAT_MANIP_SRC)