diff mbox series

[Openvpn-devel,v1] openvpnserv: pass correct NRPT domains size

Message ID 20260831184721.3391-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] openvpnserv: pass correct NRPT domains size |

Commit Message

Gert Doering Aug. 31, 2026, 6:47 p.m. UTC 
  From: Heiko Hund <heiko@ist.eigentlich.net>

Previous code assumed that the input NRPT domains list consisted of
ASCII characters only. When IDNs were passed as UTF-8 the size of the
converted wide character MULTI_SZ list was calculated wrong, leading to
extra data being read and stored in the Registry.

Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.
Contributing Researcher: Vivek Parikh.

Reported-by: Vivek Parikh <vivek.parikh@breachx.ai>
CVE: 2026-78221
Github: openvpn/openvpn-private-issues#162
Change-Id: I9ee4b6d1c21bec3873dc6a474bd65d043b5370c8
Signed-off-by: Heiko Hund <heiko@ist.eigentlich.net>
Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1887
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1887
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Razvan Cojocaru <razvanc@mailbox.org>
diff mbox series

Patch

diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c
index 36dfb8e..0c6e23f 100644
--- a/src/openvpnserv/interactive.c
+++ b/src/openvpnserv/interactive.c
@@ -2735,11 +2735,13 @@ 
         dom_size = (DWORD)domains_len + 2; /* len + the trailing NULs */
 
         wide_domains = utf8to16_size(domains, dom_size);
-        dom_size *= sizeof(*wide_domains);
         if (!wide_domains)
         {
             return ERROR_OUTOFMEMORY;
         }
+        domains_len = wcslen(wide_domains);
+        dom_size = (DWORD)(domains_len + 2) * sizeof(*wide_domains);
+
         /* Make a MULTI_SZ from a comma separated list */
         for (size_t i = 0; i < domains_len; ++i)
         {