⬢ DragonFlyBSD Kernel Audit
DF-0569 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
diff --git a/sys/net/ipfw3_nat/ip_fw3_nat.c b/sys/net/ipfw3_nat/ip_fw3_nat.c
--- a/sys/net/ipfw3_nat/ip_fw3_nat.c
+++ b/sys/net/ipfw3_nat/ip_fw3_nat.c
@@ -201,18 +201,18 @@
 		switch (ip->ip_p) {
 		case IPPROTO_TCP:
 			old_port = &L3HDR(struct tcphdr, ip)->th_dport;
-			s2 = alias->tcp_in[*old_port - ALIAS_BEGIN];
+			s2 = alias->tcp_in[ntohs(*old_port) - ALIAS_BEGIN];
 			csum = &L3HDR(struct tcphdr, ip)->th_sum;
 			break;
 		case IPPROTO_UDP:
 			old_port = &L3HDR(struct udphdr, ip)->uh_dport;
-			s2 = alias->udp_in[*old_port - ALIAS_BEGIN];
+			s2 = alias->udp_in[ntohs(*old_port) - ALIAS_BEGIN];
 			csum = &L3HDR(struct udphdr, ip)->uh_sum;
 			udp = 1;
 			break;
 		case IPPROTO_ICMP:
 			old_port = &L3HDR(struct icmp, ip)->icmp_id;
-			s2 = alias->icmp_in[*old_port];
+			s2 = alias->icmp_in[ntohs(*old_port)];
 			csum = &L3HDR(struct icmp, ip)->icmp_cksum;
 			break;
 		default:
@@ -323,7 +323,7 @@
 				s2->alias_addr = htonl(args->f_id.src_ip);
 				s2->alias_port = *old_port;
 
-				alias->icmp_in[s->alias_port] = s2;
+				alias->icmp_in[ntohs(s->alias_port)] = s2;
 				break;
 			default :
 				goto oops;
@@ -420,9 +420,9 @@
 
 			s2->timestamp = s->timestamp;
 			if (ip->ip_p == IPPROTO_TCP) {
-				alias->tcp_in[s->alias_port - ALIAS_BEGIN] = s2;
+				alias->tcp_in[ntohs(s->alias_port) - ALIAS_BEGIN] = s2;
 			} else {
-				alias->udp_in[s->alias_port - ALIAS_BEGIN] = s2;
+				alias->udp_in[ntohs(s->alias_port) - ALIAS_BEGIN] = s2;
 			}
 		}
 	}
@@ -718,9 +718,9 @@
 	}
 	s2 = msg->state;
 	if (msg->proto == IPPROTO_TCP) {
-		alias->tcp_in[msg->alias_port - ALIAS_BEGIN] = s2;
+		alias->tcp_in[ntohs(msg->alias_port) - ALIAS_BEGIN] = s2;
 	} else {
-		alias->udp_in[msg->alias_port - ALIAS_BEGIN] = s2;
+		alias->udp_in[ntohs(msg->alias_port) - ALIAS_BEGIN] = s2;
 	}
 }