For the record: while this is a buffer-overread that has been reported
as a security issue & has received a CVE ID, there does not seem to be
a way to do "more interesting things" with it than trigger ASAN complaints
(which is good). So we fix it and do not panic.
I have not tested this (beyond "BB all green" and "change looks reasonable")
but Razvan and Arne have stared harder & approved it, and the initial
reporter also confirmed the fix.
Your patch has been applied to the master branch.
commit 4654317ddc50c450aa847114f5ab7845b201023b (master)
commit 203e275f0c697340da6b49da46a5dee914632ca2 (release/2.7)
Author: Heiko Hund
Date: Mon Aug 31 20:47:15 2026 +0200
openvpnserv: pass correct NRPT domains size
Signed-off-by: Heiko Hund <[email protected]>
Acked-by: Razvan Cojocaru <[email protected]>
Acked-by: Arne Schwabe <[email protected]>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1887
Message-Id: <[email protected]>
URL:
https://www.mail-archive.com/[email protected]/msg38853.html
Signed-off-by: Gert Doering <[email protected]>
--
kind regards,
Gert Doering
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
