diff mbox series

[Openvpn-devel,v1] mbedtls: gracefully exit if certificate file is NULL

Message ID 20251206205829.27254-1-gert@greenie.muc.de
State New
Headers show
Series [Openvpn-devel,v1] mbedtls: gracefully exit if certificate file is NULL | expand

Commit Message

Gert Doering Dec. 6, 2025, 8:58 p.m. UTC 
From: Steffan Karger <steffan@karger.me>

Instead of crashing because we feed a NULL pointer to strlen(),
gracefully exit with an error message.

While at it, improve the error message a bit.

Change-Id: I0d592d9d0c7ead296869f933c206c5d55e6cbed1
Reported-By: Joshua Rogers <contact@joshua.hu>
Found-by: ZeroPath (https://zeropath.com/)
Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1419
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1419
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Gert Doering <gert@greenie.muc.de>

Comments

Gert Doering Dec. 6, 2025, 10:38 p.m. UTC | #1 
I have not tested if I can reproduce the situation (like with an empty
inline <cert></cert> cert, or somehow via management interface) or if
this is caught further upstream - but this check looks quite reasonable,
and the BBs are fine with it.

Your patch has been applied to the master branch.

commit d7c7caa370ad1fff1cd222e2499a77ea792c8a0e
Author: Steffan Karger
Date:   Sat Dec 6 21:58:16 2025 +0100

     mbedtls: gracefully exit if certificate file is NULL

     Signed-off-by: Steffan Karger <steffan@karger.me>
     Acked-by: Gert Doering <gert@greenie.muc.de>
     Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1419
     Message-Id: <20251206205829.27254-1-gert@greenie.muc.de>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg34864.html
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering
diff mbox series

Patch

diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c
index 83fca78..3440319 100644
--- a/src/openvpn/ssl_mbedtls.c
+++ b/src/openvpn/ssl_mbedtls.c
@@ -466,10 +466,14 @@ 
 
     if (cert_inline)
     {
+        if (!cert_file)
+        {
+            msg(M_FATAL, "Cannot load inline certificate: NULL");
+        }
         if (!mbed_ok(mbedtls_x509_crt_parse(ctx->crt_chain, (const unsigned char *)cert_file,
                                             strlen(cert_file) + 1)))
         {
-            msg(M_FATAL, "Cannot load inline certificate file");
+            msg(M_FATAL, "Cannot load inline certificate");
         }
     }
     else