diff mbox series

[Openvpn-devel,v1] openvpnserv: pass correct NRPT domains size

Message ID 20260831184721.3391-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] openvpnserv: pass correct NRPT domains size |

Commit Message

Gert Doering Aug. 31, 2026, 6:47 p.m. UTC 
  From: Heiko Hund <heiko@ist.eigentlich.net>

Previous code assumed that the input NRPT domains list consisted of
ASCII characters only. When IDNs were passed as UTF-8 the size of the
converted wide character MULTI_SZ list was calculated wrong, leading to
extra data being read and stored in the Registry.

Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.
Contributing Researcher: Vivek Parikh.

Reported-by: Vivek Parikh <vivek.parikh@breachx.ai>
CVE: 2026-78221
Github: openvpn/openvpn-private-issues#162
Change-Id: I9ee4b6d1c21bec3873dc6a474bd65d043b5370c8
Signed-off-by: Heiko Hund <heiko@ist.eigentlich.net>
Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1887
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1887
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Razvan Cojocaru <razvanc@mailbox.org>

Comments

Gert Doering Sept. 1, 2026, 12:44 p.m. UTC | #1 
For the record: while this is a buffer-overread that has been reported
as a security issue & has received a CVE ID, there does not seem to be
a way to do "more interesting things" with it than trigger ASAN complaints
(which is good).  So we fix it and do not panic.

I have not tested this (beyond "BB all green" and "change looks reasonable")
but Razvan and Arne have stared harder & approved it, and the initial
reporter also confirmed the fix.

Your patch has been applied to the master branch.

commit 4654317ddc50c450aa847114f5ab7845b201023b (master)
commit 203e275f0c697340da6b49da46a5dee914632ca2 (release/2.7)
Author: Heiko Hund
Date:   Mon Aug 31 20:47:15 2026 +0200

     openvpnserv: pass correct NRPT domains size

     Signed-off-by: Heiko Hund <heiko@ist.eigentlich.net>
     Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
     Acked-by: Arne Schwabe <arne@rfc2549.org>
     Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1887
     Message-Id: <20260831184721.3391-1-gert@greenie.muc.de>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg38853.html
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering
diff mbox series

Patch

diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c
index 36dfb8e..0c6e23f 100644
--- a/src/openvpnserv/interactive.c
+++ b/src/openvpnserv/interactive.c
@@ -2735,11 +2735,13 @@ 
         dom_size = (DWORD)domains_len + 2; /* len + the trailing NULs */
 
         wide_domains = utf8to16_size(domains, dom_size);
-        dom_size *= sizeof(*wide_domains);
         if (!wide_domains)
         {
             return ERROR_OUTOFMEMORY;
         }
+        domains_len = wcslen(wide_domains);
+        dom_size = (DWORD)(domains_len + 2) * sizeof(*wide_domains);
+
         /* Make a MULTI_SZ from a comma separated list */
         for (size_t i = 0; i < domains_len; ++i)
         {