Attention is currently required from: cron2, plaisthos.
Hello plaisthos,
I'd like you to reexamine a change. Please visit
http://gerrit.openvpn.net/c/openvpn/+/1914?usp=email
to look at the new patch set (#2).
Change subject: options: fix unsigned underflow when clearing domain_search_list
......................................................................
options: fix unsigned underflow when clearing domain_search_list
remove_option() and update_option() clear the domain search list with
while (o->domain_search_list_len-- > 0)
domain_search_list_len is unsigned, and the post-decrement runs on the
final test too. When the length reaches 0 the condition is false but
the decrement has already wrapped it to UINT_MAX, so the field is left
corrupted. The next reset then does
o->domain_search_list[UINT_MAX] = NULL
and walks far out of bounds, writing NULL through each slot. A server
can drive this reset path against a client with PUSH_UPDATE, so on
Windows and Android this is a remotely reachable out-of-bounds write.
v2:
Change to the semantics used for all the other lists there - set
length to 0 and clear the list with CLEAR().
Change-Id: I3724236d4acc3d05d786274d6baf34a21c570594
Signed-off-by: Cole Munz <[email protected]>
Github: OpenVPN/openvpn-private-issues#178
CVE: 2026-88964
---
M src/openvpn/options.c
1 file changed, 6 insertions(+), 8 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/14/1914/2
diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index 25a3746..f6a5fe4 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -3778,12 +3778,12 @@
memset(o->ntp, 0, sizeof(o->ntp));
o->nbdd_len = 0;
memset(o->nbdd, 0, sizeof(o->nbdd));
- while (o->domain_search_list_len-- > 0)
- {
- o->domain_search_list[o->domain_search_list_len] = NULL;
- }
+ o->domain_search_list_len = 0;
+ CLEAR(o->domain_search_list);
o->disable_nbt = 0;
o->dhcp_options = 0;
+ CLEAR(options->dns_options.from_dhcp);
+
#if defined(TARGET_ANDROID)
o->http_proxy_port = 0;
o->http_proxy = NULL;
@@ -4082,10 +4082,8 @@
CLEAR(o->ntp);
o->nbdd_len = 0;
CLEAR(o->nbdd);
- while (o->domain_search_list_len-- > 0)
- {
- o->domain_search_list[o->domain_search_list_len] = NULL;
- }
+ o->domain_search_list_len = 0;
+ CLEAR(o->domain_search_list);
o->disable_nbt = 0;
o->dhcp_options = 0;
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1914?usp=email
To unsubscribe, or for help writing mail filters, visit
http://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I3724236d4acc3d05d786274d6baf34a21c570594
Gerrit-Change-Number: 1914
Gerrit-PatchSet: 2
Gerrit-Owner: cron2 <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-CC: razvanc <[email protected]>
Gerrit-Attention: plaisthos <[email protected]>
Gerrit-Attention: cron2 <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
