path: root/net
diff options
authorPatrick McHardy <kaber@trash.net>2006-05-22 16:55:14 -0700
committerDavid S. Miller <davem@davemloft.net>2006-05-22 16:55:14 -0700
commitf41d5bb1d9f49b03af7126d07a511facbe283a92 (patch)
tree3551fffccb0cafd2851bc441cf8ea1a81716a9f7 /net
parentf5565f4a90bdfea99e4bcd8411ff5272ebdbdbf8 (diff)
[NETFILTER]: SNMP NAT: fix memory corruption
Fix memory corruption caused by snmp_trap_decode: - When snmp_trap_decode fails before the id and address are allocated, the pointers contain random memory, but are freed by the caller (snmp_parse_mangle). - When snmp_trap_decode fails after allocating just the ID, it tries to free both address and ID, but the address pointer still contains random memory. The caller frees both ID and random memory again. - When snmp_trap_decode fails after allocating both, it frees both, and the callers frees both again. The corruption can be triggered remotely when the ip_nat_snmp_basic module is loaded and traffic on port 161 or 162 is NATed. Found by multiple testcases of the trap-app and trap-enc groups of the PROTOS c06-snmpv1 testsuite. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
1 files changed, 7 insertions, 8 deletions
diff --git a/net/ipv4/netfilter/ip_nat_snmp_basic.c b/net/ipv4/netfilter/ip_nat_snmp_basic.c
index c62253845538..688a2f29fadf 100644
--- a/net/ipv4/netfilter/ip_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/ip_nat_snmp_basic.c
@@ -1003,12 +1003,12 @@ static unsigned char snmp_trap_decode(struct asn1_ctx *ctx,
return 1;
+ kfree((unsigned long *)trap->ip_address);
- kfree((unsigned long *)trap->ip_address);
return 0;
@@ -1126,11 +1126,10 @@ static int snmp_parse_mangle(unsigned char *msg,
struct snmp_v1_trap trap;
unsigned char ret = snmp_trap_decode(&ctx, &trap, map, check);
- /* Discard trap allocations regardless */
- kfree(trap.id);
- kfree((unsigned long *)trap.ip_address);
- if (!ret)
+ if (ret) {
+ kfree(trap.id);
+ kfree((unsigned long *)trap.ip_address);
+ } else
return ret;
} else {