[NETFILTER 2.4 5/6]: Fix potential memory corruption in NAT code (aka memory NAT)

[NETFILTER 2.4 5/6]: Fix potential memory corruption in NAT code (aka memory NAT)

[Patrick McHardy]

[-- Attachment #1: 5.diff --]
[-- Type: text/x-patch, Size: 1542 bytes --]

[NETFILTER]: Fix potential memory corruption in NAT code (aka memory NAT)

Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit b3db926712f01d98e672510bdb69b940e09880eb
tree aa069a1d615f75a986c4b74975ffbf00d3927cf4
parent 3828b256e2b5adae44649792fee705bc91b1c44a
author Patrick McHardy <kaber@trash.net> Sun, 31 Jul 2005 20:26:49 +0200
committer Patrick McHardy <kaber@trash.net> Sun, 31 Jul 2005 20:26:49 +0200

 net/ipv4/netfilter/ip_nat_proto_tcp.c |    3 ++-
 net/ipv4/netfilter/ip_nat_proto_udp.c |    3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/netfilter/ip_nat_proto_tcp.c b/net/ipv4/netfilter/ip_nat_proto_tcp.c
--- a/net/ipv4/netfilter/ip_nat_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_nat_proto_tcp.c
@@ -31,7 +31,8 @@ tcp_unique_tuple(struct ip_conntrack_tup
 		 enum ip_nat_manip_type maniptype,
 		 const struct ip_conntrack *conntrack)
 {
-	static u_int16_t port = 0, *portptr;
+	static u_int16_t port = 0;
+	u_int16_t *portptr;
 	unsigned int range_size, min, i;
 
 	if (maniptype == IP_NAT_MANIP_SRC)
diff --git a/net/ipv4/netfilter/ip_nat_proto_udp.c b/net/ipv4/netfilter/ip_nat_proto_udp.c
--- a/net/ipv4/netfilter/ip_nat_proto_udp.c
+++ b/net/ipv4/netfilter/ip_nat_proto_udp.c
@@ -32,7 +32,8 @@ udp_unique_tuple(struct ip_conntrack_tup
 		 enum ip_nat_manip_type maniptype,
 		 const struct ip_conntrack *conntrack)
 {
-	static u_int16_t port = 0, *portptr;
+	static u_int16_t port = 0;
+	u_int16_t *portptr;
 	unsigned int range_size, min, i;
 
 	if (maniptype == IP_NAT_MANIP_SRC)