[Openvpn-devel] [XS] Change in openvpn[master]: mudp: fix unaligned 32-bit read when parsing peer ID

2025-12-10 Thread cron2 (Code Review)
cron2 has uploaded a new patch set (#4) to the change originally created by 
its_Giaan. ( http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email )

The following approvals got outdated and were removed:
Code-Review+2 by cron2


Change subject: mudp: fix unaligned 32-bit read when parsing peer ID
..

mudp: fix unaligned 32-bit read when parsing peer ID

The code previously read a 32-bit value from a uint8_t
buffer using a direct cast and dereference.
This can cause unaligned memory access and undefined
behavior on architectures that do not support unaligned
reads, potentially leading to a one-packet crash.

Fix this by reading the bytes individually and
combining them manually.

Reported-By: Joshua Rogers 
Found-By: ZeroPath (https://zeropath.com)

Change-Id: Id0bb4c45d373437ab8dbaff7a311745f9b538cbf
Signed-off-by: Gianmarco De Gregori 
Acked-by: Gert Doering 
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1348
Message-Id: <[email protected]>
Signed-off-by: Gert Doering 
---
M src/openvpn/mudp.c
1 file changed, 1 insertion(+), 1 deletion(-)


  git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/48/1348/4

diff --git a/src/openvpn/mudp.c b/src/openvpn/mudp.c
index b03e165..5de3af6 100644
--- a/src/openvpn/mudp.c
+++ b/src/openvpn/mudp.c
@@ -209,7 +209,7 @@
 /* make sure buffer has enough length to read opcode (1 byte) and 
peer-id (3 bytes) */
 if (v2)
 {
-uint32_t peer_id = ntohl(*(uint32_t *)ptr) & 0xFF;
+uint32_t peer_id = ((uint32_t)ptr[1] << 16) | ((uint32_t)ptr[2] << 
8) | ((uint32_t)ptr[3]);
 peer_id_disabled = (peer_id == MAX_PEER_ID);

 if (!peer_id_disabled && (peer_id < m->max_clients) && 
(m->instances[peer_id]))

--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id0bb4c45d373437ab8dbaff7a311745f9b538cbf
Gerrit-Change-Number: 1348
Gerrit-PatchSet: 4
Gerrit-Owner: its_Giaan 
Gerrit-Reviewer: cron2 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: openvpn-devel 
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel


[Openvpn-devel] [XS] Change in openvpn[master]: mudp: fix unaligned 32-bit read when parsing peer ID

2025-12-10 Thread cron2 (Code Review)
cron2 has submitted this change. ( 
http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email )

Change subject: mudp: fix unaligned 32-bit read when parsing peer ID
..

mudp: fix unaligned 32-bit read when parsing peer ID

The code previously read a 32-bit value from a uint8_t
buffer using a direct cast and dereference.
This can cause unaligned memory access and undefined
behavior on architectures that do not support unaligned
reads, potentially leading to a one-packet crash.

Fix this by reading the bytes individually and
combining them manually.

Reported-By: Joshua Rogers 
Found-By: ZeroPath (https://zeropath.com)

Change-Id: Id0bb4c45d373437ab8dbaff7a311745f9b538cbf
Signed-off-by: Gianmarco De Gregori 
Acked-by: Gert Doering 
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1348
Message-Id: <[email protected]>
Signed-off-by: Gert Doering 
---
M src/openvpn/mudp.c
1 file changed, 1 insertion(+), 1 deletion(-)




diff --git a/src/openvpn/mudp.c b/src/openvpn/mudp.c
index b03e165..5de3af6 100644
--- a/src/openvpn/mudp.c
+++ b/src/openvpn/mudp.c
@@ -209,7 +209,7 @@
 /* make sure buffer has enough length to read opcode (1 byte) and 
peer-id (3 bytes) */
 if (v2)
 {
-uint32_t peer_id = ntohl(*(uint32_t *)ptr) & 0xFF;
+uint32_t peer_id = ((uint32_t)ptr[1] << 16) | ((uint32_t)ptr[2] << 
8) | ((uint32_t)ptr[3]);
 peer_id_disabled = (peer_id == MAX_PEER_ID);

 if (!peer_id_disabled && (peer_id < m->max_clients) && 
(m->instances[peer_id]))

--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: merged
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id0bb4c45d373437ab8dbaff7a311745f9b538cbf
Gerrit-Change-Number: 1348
Gerrit-PatchSet: 4
Gerrit-Owner: its_Giaan 
Gerrit-Reviewer: cron2 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: openvpn-devel 
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel


[Openvpn-devel] [XS] Change in openvpn[master]: mudp: fix unaligned 32-bit read when parsing peer ID

2025-12-10 Thread cron2 (Code Review)
Attention is currently required from: flichtenheld, its_Giaan, plaisthos.

cron2 has posted comments on this change by its_Giaan. ( 
http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email )

Change subject: mudp: fix unaligned 32-bit read when parsing peer ID
..


Patch Set 3: Code-Review+2


--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id0bb4c45d373437ab8dbaff7a311745f9b538cbf
Gerrit-Change-Number: 1348
Gerrit-PatchSet: 3
Gerrit-Owner: its_Giaan 
Gerrit-Reviewer: cron2 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: openvpn-devel 
Gerrit-Attention: plaisthos 
Gerrit-Attention: its_Giaan 
Gerrit-Attention: flichtenheld 
Gerrit-Comment-Date: Wed, 10 Dec 2025 10:48:24 +
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel


[Openvpn-devel] [XS] Change in openvpn[master]: mudp: fix unaligned 32-bit read when parsing peer ID

2025-12-01 Thread its_Giaan (Code Review)
Attention is currently required from: cron2, flichtenheld, plaisthos.

its_Giaan has posted comments on this change by its_Giaan. ( 
http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email )

Change subject: mudp: fix unaligned 32-bit read when parsing peer ID
..


Patch Set 3:

(1 comment)

Commit Message:

http://gerrit.openvpn.net/c/openvpn/+/1348/comment/c8e93574_8ee11a7d?usp=email :
PS2, Line 15: Fix this by read the bytes individually and combine
> Either "Fix this by reading the bytes individually and combining them 
> manually. […]
Done



--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id0bb4c45d373437ab8dbaff7a311745f9b538cbf
Gerrit-Change-Number: 1348
Gerrit-PatchSet: 3
Gerrit-Owner: its_Giaan 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: cron2 
Gerrit-CC: openvpn-devel 
Gerrit-Attention: plaisthos 
Gerrit-Attention: cron2 
Gerrit-Attention: flichtenheld 
Gerrit-Comment-Date: Mon, 01 Dec 2025 21:17:14 +
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: flichtenheld 
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel


[Openvpn-devel] [XS] Change in openvpn[master]: mudp: fix unaligned 32-bit read when parsing peer ID

2025-12-01 Thread its_Giaan (Code Review)
Attention is currently required from: cron2, its_Giaan, plaisthos.

Hello flichtenheld, plaisthos,

I'd like you to reexamine a change. Please visit

http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email

to look at the new patch set (#3).


Change subject: mudp: fix unaligned 32-bit read when parsing peer ID
..

mudp: fix unaligned 32-bit read when parsing peer ID

The code previously read a 32-bit value from a uint8_t
buffer using a direct cast and dereference.
This can cause unaligned memory access and undefined
behavior on architectures that do not support unaligned
reads, potentially leading to a one-packet crash.

Fix this by reading the bytes individually and
combining them manually.

Reported-By: Joshua Rogers 
Found-By: ZeroPath (https://zeropath.com)

Change-Id: Id0bb4c45d373437ab8dbaff7a311745f9b538cbf
Signed-off-by: Gianmarco De Gregori 
---
M src/openvpn/mudp.c
1 file changed, 1 insertion(+), 1 deletion(-)


  git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/48/1348/3

diff --git a/src/openvpn/mudp.c b/src/openvpn/mudp.c
index b03e165..5de3af6 100644
--- a/src/openvpn/mudp.c
+++ b/src/openvpn/mudp.c
@@ -209,7 +209,7 @@
 /* make sure buffer has enough length to read opcode (1 byte) and 
peer-id (3 bytes) */
 if (v2)
 {
-uint32_t peer_id = ntohl(*(uint32_t *)ptr) & 0xFF;
+uint32_t peer_id = ((uint32_t)ptr[1] << 16) | ((uint32_t)ptr[2] << 
8) | ((uint32_t)ptr[3]);
 peer_id_disabled = (peer_id == MAX_PEER_ID);

 if (!peer_id_disabled && (peer_id < m->max_clients) && 
(m->instances[peer_id]))

--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id0bb4c45d373437ab8dbaff7a311745f9b538cbf
Gerrit-Change-Number: 1348
Gerrit-PatchSet: 3
Gerrit-Owner: its_Giaan 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: cron2 
Gerrit-CC: openvpn-devel 
Gerrit-Attention: plaisthos 
Gerrit-Attention: its_Giaan 
Gerrit-Attention: cron2 
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel


[Openvpn-devel] [XS] Change in openvpn[master]: mudp: fix unaligned 32-bit read when parsing peer ID

2025-12-01 Thread flichtenheld (Code Review)
Attention is currently required from: cron2, its_Giaan, plaisthos.

flichtenheld has posted comments on this change by its_Giaan. ( 
http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email )

Change subject: mudp: fix unaligned 32-bit read when parsing peer ID
..


Patch Set 2:

(1 comment)

Commit Message:

http://gerrit.openvpn.net/c/openvpn/+/1348/comment/937807d7_bfbf6f4f?usp=email :
PS2, Line 15: Fix this by read the bytes individually and combine
Either "Fix this by reading the bytes individually and combining them 
manually." Or "To fix this read the bytes individually and combine them 
manually."



--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id0bb4c45d373437ab8dbaff7a311745f9b538cbf
Gerrit-Change-Number: 1348
Gerrit-PatchSet: 2
Gerrit-Owner: its_Giaan 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: cron2 
Gerrit-CC: openvpn-devel 
Gerrit-Attention: plaisthos 
Gerrit-Attention: its_Giaan 
Gerrit-Attention: cron2 
Gerrit-Comment-Date: Mon, 01 Dec 2025 16:20:52 +
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel


[Openvpn-devel] [XS] Change in openvpn[master]: mudp: fix unaligned 32-bit read when parsing peer ID

2025-12-01 Thread its_Giaan (Code Review)
Attention is currently required from: flichtenheld, its_Giaan, plaisthos.

Hello flichtenheld, plaisthos,

I'd like you to reexamine a change. Please visit

http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email

to look at the new patch set (#2).

The following approvals got outdated and were removed:
Code-Review+2 by flichtenheld

The change is no longer submittable: Code-Review and checks~ChecksSubmitRule 
are unsatisfied now.


Change subject: mudp: fix unaligned 32-bit read when parsing peer ID
..

mudp: fix unaligned 32-bit read when parsing peer ID

The code previously read a 32-bit value from a uint8_t
buffer using a direct cast and dereference.
This can cause unaligned memory access and undefined
behavior on architectures that do not support unaligned
reads, potentially leading to a one-packet crash.

Fix this by read the bytes individually and combine
them manually.

Reported-By: Joshua Rogers 
Found-By: ZeroPath (https://zeropath.com)

Change-Id: Id0bb4c45d373437ab8dbaff7a311745f9b538cbf
Signed-off-by: Gianmarco De Gregori 
---
M src/openvpn/mudp.c
1 file changed, 1 insertion(+), 1 deletion(-)


  git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/48/1348/2

diff --git a/src/openvpn/mudp.c b/src/openvpn/mudp.c
index b03e165..5de3af6 100644
--- a/src/openvpn/mudp.c
+++ b/src/openvpn/mudp.c
@@ -209,7 +209,7 @@
 /* make sure buffer has enough length to read opcode (1 byte) and 
peer-id (3 bytes) */
 if (v2)
 {
-uint32_t peer_id = ntohl(*(uint32_t *)ptr) & 0xFF;
+uint32_t peer_id = ((uint32_t)ptr[1] << 16) | ((uint32_t)ptr[2] << 
8) | ((uint32_t)ptr[3]);
 peer_id_disabled = (peer_id == MAX_PEER_ID);

 if (!peer_id_disabled && (peer_id < m->max_clients) && 
(m->instances[peer_id]))

--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id0bb4c45d373437ab8dbaff7a311745f9b538cbf
Gerrit-Change-Number: 1348
Gerrit-PatchSet: 2
Gerrit-Owner: its_Giaan 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: cron2 
Gerrit-CC: openvpn-devel 
Gerrit-Attention: plaisthos 
Gerrit-Attention: its_Giaan 
Gerrit-Attention: flichtenheld 
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel


[Openvpn-devel] [XS] Change in openvpn[master]: mudp: fix unaligned 32-bit read when parsing peer ID

2025-12-01 Thread its_Giaan (Code Review)
Attention is currently required from: cron2, flichtenheld, plaisthos.

its_Giaan has posted comments on this change by its_Giaan. ( 
http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email )

Change subject: mudp: fix unaligned 32-bit read when parsing peer ID
..


Patch Set 2:

(1 comment)

File src/openvpn/mudp.c:

http://gerrit.openvpn.net/c/openvpn/+/1348/comment/6833f3d3_0f5de10b?usp=email :
PS1, Line 213: memcpy(&tmp, ptr, sizeof(tmp));
> I am thinking of something more straightforward... […]
Done



--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id0bb4c45d373437ab8dbaff7a311745f9b538cbf
Gerrit-Change-Number: 1348
Gerrit-PatchSet: 2
Gerrit-Owner: its_Giaan 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: cron2 
Gerrit-CC: openvpn-devel 
Gerrit-Attention: plaisthos 
Gerrit-Attention: cron2 
Gerrit-Attention: flichtenheld 
Gerrit-Comment-Date: Mon, 01 Dec 2025 16:03:31 +
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: cron2 
Comment-In-Reply-To: flichtenheld 
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel


[Openvpn-devel] [XS] Change in openvpn[master]: mudp: fix unaligned 32-bit read when parsing peer ID

2025-11-14 Thread cron2 (Code Review)
Attention is currently required from: its_Giaan, plaisthos.

cron2 has posted comments on this change by its_Giaan. ( 
http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email )

Change subject: mudp: fix unaligned 32-bit read when parsing peer ID
..


Patch Set 1:

(1 comment)

File src/openvpn/mudp.c:

http://gerrit.openvpn.net/c/openvpn/+/1348/comment/3f419bdf_37dbf5a2?usp=email :
PS1, Line 213: memcpy(&tmp, ptr, sizeof(tmp));
> This reimplements the same logic as buf_read_u32() except that it doesn't 
> advance the buffer. […]
I am thinking of something more straightforward...

```
/* peer_id is a 24 byte integer in network byte order */
peer_id = (ptr[1]<<16) + (ptr[2]<<8) + ptr[3]
```

(or the other way round, didn't do the byte order calculations yet)...



--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id0bb4c45d373437ab8dbaff7a311745f9b538cbf
Gerrit-Change-Number: 1348
Gerrit-PatchSet: 1
Gerrit-Owner: its_Giaan 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: cron2 
Gerrit-CC: openvpn-devel 
Gerrit-Attention: plaisthos 
Gerrit-Attention: its_Giaan 
Gerrit-Comment-Date: Fri, 14 Nov 2025 18:39:24 +
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: flichtenheld 
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel


[Openvpn-devel] [XS] Change in openvpn[master]: mudp: fix unaligned 32-bit read when parsing peer ID

2025-11-14 Thread flichtenheld (Code Review)
Attention is currently required from: its_Giaan, plaisthos.

flichtenheld has posted comments on this change by its_Giaan. ( 
http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email )

Change subject: mudp: fix unaligned 32-bit read when parsing peer ID
..


Patch Set 1:

(1 comment)

File src/openvpn/mudp.c:

http://gerrit.openvpn.net/c/openvpn/+/1348/comment/b1c152bd_e837d78c?usp=email :
PS1, Line 213: memcpy(&tmp, ptr, sizeof(tmp));
This reimplements the same logic as buf_read_u32() except that it doesn't 
advance the buffer. Would it be possible to use that function instead?



--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id0bb4c45d373437ab8dbaff7a311745f9b538cbf
Gerrit-Change-Number: 1348
Gerrit-PatchSet: 1
Gerrit-Owner: its_Giaan 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: openvpn-devel 
Gerrit-Attention: plaisthos 
Gerrit-Attention: its_Giaan 
Gerrit-Comment-Date: Fri, 14 Nov 2025 16:07:51 +
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel


[Openvpn-devel] [XS] Change in openvpn[master]: mudp: fix unaligned 32-bit read when parsing peer ID

2025-11-06 Thread flichtenheld (Code Review)
Attention is currently required from: its_Giaan, plaisthos.

flichtenheld has posted comments on this change by its_Giaan. ( 
http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email )

Change subject: mudp: fix unaligned 32-bit read when parsing peer ID
..


Patch Set 1: Code-Review+2


--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: comment
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id0bb4c45d373437ab8dbaff7a311745f9b538cbf
Gerrit-Change-Number: 1348
Gerrit-PatchSet: 1
Gerrit-Owner: its_Giaan 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: openvpn-devel 
Gerrit-Attention: plaisthos 
Gerrit-Attention: its_Giaan 
Gerrit-Comment-Date: Thu, 06 Nov 2025 13:19:53 +
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel


[Openvpn-devel] [XS] Change in openvpn[master]: mudp: fix unaligned 32-bit read when parsing peer ID

2025-11-04 Thread its_Giaan (Code Review)
Attention is currently required from: flichtenheld, plaisthos.

Hello plaisthos, flichtenheld,

I'd like you to do a code review.
Please visit

http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email

to review the following change.


Change subject: mudp: fix unaligned 32-bit read when parsing peer ID
..

mudp: fix unaligned 32-bit read when parsing peer ID

The code previously read a 32-bit value from a uint8_t
buffer using a direct cast and dereference.
This can cause unaligned memory access and undefined
behavior on architectures that do not support unaligned
reads, potentially leading to a one-packet crash.

This patch replaces the unsafe cast with a safe
memcpy-based read.

Reported-By: Joshua Rogers 
Found-By: ZeroPath (https://zeropath.com)

Change-Id: Id0bb4c45d373437ab8dbaff7a311745f9b538cbf
Signed-off-by: Gianmarco De Gregori 
---
M src/openvpn/mudp.c
1 file changed, 3 insertions(+), 1 deletion(-)



  git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/48/1348/1

diff --git a/src/openvpn/mudp.c b/src/openvpn/mudp.c
index 31134be..0653b219 100644
--- a/src/openvpn/mudp.c
+++ b/src/openvpn/mudp.c
@@ -209,7 +209,9 @@
 /* make sure buffer has enough length to read opcode (1 byte) and 
peer-id (3 bytes) */
 if (v2)
 {
-uint32_t peer_id = ntohl(*(uint32_t *)ptr) & 0xFF;
+uint32_t tmp;
+memcpy(&tmp, ptr, sizeof(tmp));
+uint32_t peer_id = ntohl(tmp) & 0xFF;
 peer_id_disabled = (peer_id == MAX_PEER_ID);

 if (!peer_id_disabled && (peer_id < m->max_clients) && 
(m->instances[peer_id]))

--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1348?usp=email
To unsubscribe, or for help writing mail filters, visit 
http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: newchange
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id0bb4c45d373437ab8dbaff7a311745f9b538cbf
Gerrit-Change-Number: 1348
Gerrit-PatchSet: 1
Gerrit-Owner: its_Giaan 
Gerrit-Reviewer: flichtenheld 
Gerrit-Reviewer: plaisthos 
Gerrit-CC: openvpn-devel 
Gerrit-Attention: plaisthos 
Gerrit-Attention: flichtenheld 
___
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel