redonkable/alistair23-linux
redonkable/alistair23-linux
1
0
Fork 0
Code Releases Activity

[NETFILTER]: Fix crash in ip_nat_pptp

Browse source 
When an inbound PPTP_IN_CALL_REQUEST packet is received the
PPTP NAT helper uses a NULL pointer in pointer arithmentic to
calculate the offset in the packet which needs to be mangled
and corrupts random memory or crashes.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Patrick McHardy 2006-01-09 16:43:43 -08:00 committed by David S. Miller
parent bb94aa169e
commit 15db34702c
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
net/ipv4/netfilter/ip_nat_helper_pptp.c
View file

@ -315,7 +315,7 @@ pptp_inbound_pkt(struct sk_buff **pskb,
break; break;
case PPTP_IN_CALL_REQUEST: case PPTP_IN_CALL_REQUEST:
/* only need to nat in case PAC is behind NAT box */ /* only need to nat in case PAC is behind NAT box */
break; return NF_ACCEPT;
case PPTP_WAN_ERROR_NOTIFY: case PPTP_WAN_ERROR_NOTIFY:
pcid = &pptpReq->wanerr.peersCallID; pcid = &pptpReq->wanerr.peersCallID;
break; break;