diff options
| author | Patrick McHardy <kaber@trash.net> | 2005-09-13 20:48:00 (GMT) |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2005-09-13 20:48:00 (GMT) |
| commit | 5cb30640ce01d76d256533bb2824c9cc14eb4070 (patch) | |
| tree | 1ed9c7e0c13c049dbc8bcc55a852dc0aad00df3d /net/ipv4/netfilter/ip_conntrack_irc.c | |
| parent | f3591fff043f5df937120962668c8adfcd3f5b29 (diff) | |
| download | linux-5cb30640ce01d76d256533bb2824c9cc14eb4070.tar.xz | |
[NETFILTER]: Use correct type for "ports" module parameter
With large port numbers the helper_names buffer can overflow.
Noticed by Samir Bellabes <sbellabes@mandriva.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/netfilter/ip_conntrack_irc.c')
| -rw-r--r-- | net/ipv4/netfilter/ip_conntrack_irc.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/ipv4/netfilter/ip_conntrack_irc.c b/net/ipv4/netfilter/ip_conntrack_irc.c index d7a8a98..1545741 100644 --- a/net/ipv4/netfilter/ip_conntrack_irc.c +++ b/net/ipv4/netfilter/ip_conntrack_irc.c @@ -34,7 +34,7 @@ #include <linux/moduleparam.h> #define MAX_PORTS 8 -static int ports[MAX_PORTS]; +static short ports[MAX_PORTS]; static int ports_c; static int max_dcc_channels = 8; static unsigned int dcc_timeout = 300; @@ -52,7 +52,7 @@ EXPORT_SYMBOL_GPL(ip_nat_irc_hook); MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); MODULE_DESCRIPTION("IRC (DCC) connection tracking helper"); MODULE_LICENSE("GPL"); -module_param_array(ports, int, &ports_c, 0400); +module_param_array(ports, short, &ports_c, 0400); MODULE_PARM_DESC(ports, "port numbers of IRC servers"); module_param(max_dcc_channels, int, 0400); MODULE_PARM_DESC(max_dcc_channels, "max number of expected DCC channels per IRC session"); @@ -240,7 +240,7 @@ static int help(struct sk_buff **pskb, } static struct ip_conntrack_helper irc_helpers[MAX_PORTS]; -static char irc_names[MAX_PORTS][10]; +static char irc_names[MAX_PORTS][sizeof("irc-65535")]; static void fini(void); |