misc/136893: ppp(8) crashing with port 65535 in "nat port"

[Aragon Gouveia]

>Number:         136893
>Category:       misc
>Synopsis:       ppp(8) crashing with port 65535 in "nat port"
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Jul 19 02:10:01 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Aragon Gouveia
>Release:        8.0-BETA1
>Organization:
>Environment:
FreeBSD soek.geek.sh 8.0-BETA1 FreeBSD 8.0-BETA1 #0: Sat Jul 18 01:46:02 SAST 2009     root at fuzz.geek.sh:/usr/obj/nanobsd.soek/i386/usr/src/sys/SOEK  i386
>Description:
I'm using ppp(8) to run a PPPoE session to my ISP.  I've noticed by accident that configuring it to redirect port 65535 with the "nat port" config option causes ppp to consume an ever increasing amount of memory during start up, eventually being killed by the kernel.
>How-To-Repeat:
add "nat port tcp 1.2.3.4:65535 65535" to ppp.conf

>Fix:
A variable that's the condition of a while loop is overflowing.  Quick fix:


--- usr.sbin/ppp/nat_cmd.c.orig	2009-07-19 03:50:27.000000000 +0200
+++ usr.sbin/ppp/nat_cmd.c	2009-07-19 03:50:20.000000000 +0200
@@ -184,6 +184,7 @@
                       error);
         return 1;
       }
+      if (laliasport == 65535) break;
       llocalport++;
       laliasport++;
       if (hremoteport)


>Release-Note:
>Audit-Trail:
>Unformatted: