cron2 has submitted this change. ( http://gerrit.openvpn.net/c/openvpn/+/1887?usp=email )
Change subject: openvpnserv: pass correct NRPT domains size ...................................................................... openvpnserv: pass correct NRPT domains size Previous code assumed that the input NRPT domains list consisted of ASCII characters only. When IDNs were passed as UTF-8 the size of the converted wide character MULTI_SZ list was calculated wrong, leading to extra data being read and stored in the Registry. Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2. Contributing Researcher: Vivek Parikh. Reported-by: Vivek Parikh <[email protected]> Tested-by: Vivek Parikh <[email protected]> CVE: 2026-78221 Github: openvpn/openvpn-private-issues#162 Change-Id: I9ee4b6d1c21bec3873dc6a474bd65d043b5370c8 Signed-off-by: Heiko Hund <[email protected]> Acked-by: Razvan Cojocaru <[email protected]> Acked-by: Arne Schwabe <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1887 Message-Id: <[email protected]> URL: https://www.mail-archive.com/[email protected]/msg38853.html Signed-off-by: Gert Doering <[email protected]> --- M src/openvpnserv/interactive.c 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c index 36dfb8e..0c6e23f 100644 --- a/src/openvpnserv/interactive.c +++ b/src/openvpnserv/interactive.c @@ -2735,11 +2735,13 @@ dom_size = (DWORD)domains_len + 2; /* len + the trailing NULs */ wide_domains = utf8to16_size(domains, dom_size); - dom_size *= sizeof(*wide_domains); if (!wide_domains) { return ERROR_OUTOFMEMORY; } + domains_len = wcslen(wide_domains); + dom_size = (DWORD)(domains_len + 2) * sizeof(*wide_domains); + /* Make a MULTI_SZ from a comma separated list */ for (size_t i = 0; i < domains_len; ++i) { -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1887?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I9ee4b6d1c21bec3873dc6a474bd65d043b5370c8 Gerrit-Change-Number: 1887 Gerrit-PatchSet: 2 Gerrit-Owner: cron2 <[email protected]> Gerrit-Reviewer: plaisthos <[email protected]> Gerrit-Reviewer: razvanc <[email protected]> Gerrit-CC: d12fk <[email protected]> Gerrit-CC: openvpn-devel <[email protected]>
_______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
