Attention is currently required from: plaisthos.
Hello plaisthos,
I'd like you to do a code review.
Please visit
http://gerrit.openvpn.net/c/openvpn/+/1914?usp=email
to review the following change.
Change subject: options: fix unsigned underflow when clearing domain_search_list
......................................................................
options: fix unsigned underflow when clearing domain_search_list
remove_option() and update_option() clear the domain search list with
while (o->domain_search_list_len-- > 0)
domain_search_list_len is unsigned, and the post-decrement runs on the
final test too. When the length reaches 0 the condition is false but
the decrement has already wrapped it to SIZE_MAX, so the field is left
corrupted. The next reset then does
o->domain_search_list[SIZE_MAX] = NULL
and walks far out of bounds, writing NULL through each slot. A server
can drive this reset path against a client with PUSH_UPDATE, so on
Windows and Android this is a remotely reachable out-of-bounds write.
Test the length before decrementing, and decrement as part of the
index, so it is never taken below 0.
Change-Id: I3724236d4acc3d05d786274d6baf34a21c570594
Signed-off-by: Cole Munz <[email protected]>
Github: OpenVPN/openvpn-private-issues#178
CVE: 2026-88964
---
M src/openvpn/options.c
1 file changed, 6 insertions(+), 4 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/14/1914/1
diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index 25a3746..d642731 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -3778,12 +3778,14 @@
memset(o->ntp, 0, sizeof(o->ntp));
o->nbdd_len = 0;
memset(o->nbdd, 0, sizeof(o->nbdd));
- while (o->domain_search_list_len-- > 0)
+ while (o->domain_search_list_len > 0)
{
- o->domain_search_list[o->domain_search_list_len] = NULL;
+ o->domain_search_list[--(o->domain_search_list_len)] = NULL;
}
o->disable_nbt = 0;
o->dhcp_options = 0;
+ CLEAR(options->dns_options.from_dhcp);
+
#if defined(TARGET_ANDROID)
o->http_proxy_port = 0;
o->http_proxy = NULL;
@@ -4082,9 +4084,9 @@
CLEAR(o->ntp);
o->nbdd_len = 0;
CLEAR(o->nbdd);
- while (o->domain_search_list_len-- > 0)
+ while (o->domain_search_list_len > 0)
{
- o->domain_search_list[o->domain_search_list_len] = NULL;
+ o->domain_search_list[--(o->domain_search_list_len)] = NULL;
}
o->disable_nbt = 0;
o->dhcp_options = 0;
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1914?usp=email
To unsubscribe, or for help writing mail filters, visit
http://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I3724236d4acc3d05d786274d6baf34a21c570594
Gerrit-Change-Number: 1914
Gerrit-PatchSet: 1
Gerrit-Owner: cron2 <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: plaisthos <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
