Messages in this thread Patch in this message | | | Date | Thu, 12 Jan 2006 18:37:47 -0800 | From | Chris Wright <> | Subject | [PATCH 09/17] [NETFILTER]: Fix crash in ip_nat_pptp |
| |
-stable review patch. If anyone has any objections, please let us know. ------------------
When an inbound PPTP_IN_CALL_REQUEST packet is received the PPTP NAT helper uses a NULL pointer in pointer arithmentic to calculate the offset in the packet which needs to be mangled and corrupts random memory or crashes.
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Chris Wright <chrisw@sous-sol.org> --- net/ipv4/netfilter/ip_nat_helper_pptp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- linux-2.6.15.y.orig/net/ipv4/netfilter/ip_nat_helper_pptp.c +++ linux-2.6.15.y/net/ipv4/netfilter/ip_nat_helper_pptp.c @@ -315,7 +315,7 @@ pptp_inbound_pkt(struct sk_buff **pskb, break; case PPTP_IN_CALL_REQUEST: /* only need to nat in case PAC is behind NAT box */ - break; + return NF_ACCEPT; case PPTP_WAN_ERROR_NOTIFY: pcid = &pptpReq->wanerr.peersCallID; break; -- - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |