From patchwork Mon Aug 31 18:47:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5304 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:c317:b0:87d:ab56:3700 with SMTP id jk23csp3570684mab; Mon, 31 Aug 2026 11:47:34 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RqBgR9bRAaue6E/5xdVN3eZxnDQfEXCrt8neg21IjrESgoBsP0EgmJ33kG2A2LGSbaidjtTyCjB1e4=@openvpn.net X-Received: by 2002:a05:6870:ab08:b0:463:6fe7:6818 with SMTP id 586e51a60fabf-46afeeea772mr347028fac.7.1788202053904; Mon, 31 Aug 2026 11:47:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1788202053; cv=none; d=google.com; s=arc-20260327; b=SjKnYxY5UXXge12bHXHqmc5sM5MdYSWh2N1xZhj9hYLbpg45EePuDUvAbSzMyh7/NN mcBz4Yx5rTK6Zypbu4UIN/e21h5LjydDUmDljP4MXPhqsDmi0fqfgcA/4hAc6rYAsYr/ RzBaNRR22Pcq6Foca/ruOZRa/cxreiZ4mot/wj/EAaEeuJHRBx+H/Rv6QF1DdwTMdtQ4 CNSNKHhiw5lmSHO7ZDnGcMh1XQMga8ksTx1nKt+bp8533YXOw6xQ4aWksKMZB+NwjSKr k43FKFEgjzNMiTlEVo/faQ5yxNhqEn6XJhAOwd7z8Qqs+TcRol9nGLleYXUU3ineSc9x V2YA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=u21+U3HpG0P4smrN9mbfqMZLetbpxy1xuq01PPzDGSs=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=ZG8HxRSCJMvi4fkpDylprbI0ZPHuIT1R2+sHtJR3YHg5IHDjxP1ltbNb1Q2e0ZU7qG n6n0qnVOASur5Rw++Osu8YcsgK/w0EISjibkJ5fkXaeYXs5HHuzYa9UMWA9bsQK991YU YLRd7hahhrW7lvkAmRbVuaRb3XWnolX4n8XfwexgzQyZ3hw4dwBjjCkVhmKbJm/g1CZJ 5bAffwRUQWOAjVN2DtEPwTCE62LmgTS4lp51MWPo5CT6ZnquwPXOn5wuLSuiiKutTOgj Rf/moGI+LlEpUaACiYho3MEwVqPMo7IM2FJMAjGGbg5kCsT29r7cmIdsxyAv8TAZU1WR tzZA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=NAj1OfTu; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=OpxHeJcx; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=nBMdRmq5; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-468a59ae871si13422731fac.162.2026.08.31.11.47.33 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 31 Aug 2026 11:47:33 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=NAj1OfTu; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=OpxHeJcx; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=nBMdRmq5; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=u21+U3HpG0P4smrN9mbfqMZLetbpxy1xuq01PPzDGSs=; b=NAj1OfTuvp3hFenmIrQybLeXW5 4UTR56t5pHqirrWSqjyPBi5POaF7WS+SY2c3g+oK6JltCB+ZVExXQeePKk9XOqGMR2oj2SAwzikNU fAIfThrRLr4JMf7IIc3bo2qFE5AMBhhaJpwuMcbRkun9MXbNJJKUYapDrHy35eeBUZX4=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1x172Y-0005Bm-2B; Mon, 31 Aug 2026 18:47:30 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1x172W-0005BY-9h for openvpn-devel@lists.sourceforge.net; Mon, 31 Aug 2026 18:47:29 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=AjLkKPto+r2EQ8sOwUBWEDNCgin2vpazp4r8pWzzA4I=; b=OpxHeJcxrQ+mE/ypDCNvzpY4A8 hxtDaGxFR9rf/X3Bz9JOQqPIMvSK+raUDyTpavBFgs94rqtx5xMKiMEXL6Y9sWE3DlkaagX2l4FU1 UAU8e7alWkupLQ/wkgwzHV3IJdSyvGKE5ht6P7pNd5wnaDgwbfbPjgXv0gOSR8woCqSk=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=AjLkKPto+r2EQ8sOwUBWEDNCgin2vpazp4r8pWzzA4I=; b=nBMdRmq5iQVKxjDn4bDT3AxFtx VFrTG3CA/5mQQmfmlpsd+d5/EMhj/G74sL2aX34PQg8fMS8QHDDPca7Gnyctt6wutYw/zo4Xyi9os I6NlPNdGE4396qVAjgHUuhpdpijBUo8ahvHUp/6nSt1pSVtPjBeyOVjcIGCWG5zRzvD0=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1x172W-0004BW-40 for openvpn-devel@lists.sourceforge.net; Mon, 31 Aug 2026 18:47:29 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 67VIlL3C003403 for ; Mon, 31 Aug 2026 20:47:21 +0200 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 67VIlLkR003402 for openvpn-devel@lists.sourceforge.net; Mon, 31 Aug 2026 20:47:21 +0200 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Mon, 31 Aug 2026 20:47:15 +0200 Message-ID: <20260831184721.3391-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.53.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Heiko Hund Previous code assumed that the input NRPT domains list consisted of ASCII characters only. When IDNs were passed as UTF-8 the size of the converted wide character MULTI_SZ list was calculated wrong, l [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1x172W-0004BW-40 Subject: [Openvpn-devel] [PATCH v1] openvpnserv: pass correct NRPT domains size X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1875065756673594883 X-GMAIL-MSGID: 1875065756673594883 From: Heiko Hund Previous code assumed that the input NRPT domains list consisted of ASCII characters only. When IDNs were passed as UTF-8 the size of the converted wide character MULTI_SZ list was calculated wrong, leading to extra data being read and stored in the Registry. Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2. Contributing Researcher: Vivek Parikh. Reported-by: Vivek Parikh CVE: 2026-78221 Github: openvpn/openvpn-private-issues#162 Change-Id: I9ee4b6d1c21bec3873dc6a474bd65d043b5370c8 Signed-off-by: Heiko Hund Acked-by: Razvan Cojocaru Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1887 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1887 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c index 36dfb8e..0c6e23f 100644 --- a/src/openvpnserv/interactive.c +++ b/src/openvpnserv/interactive.c @@ -2735,11 +2735,13 @@ dom_size = (DWORD)domains_len + 2; /* len + the trailing NULs */ wide_domains = utf8to16_size(domains, dom_size); - dom_size *= sizeof(*wide_domains); if (!wide_domains) { return ERROR_OUTOFMEMORY; } + domains_len = wcslen(wide_domains); + dom_size = (DWORD)(domains_len + 2) * sizeof(*wide_domains); + /* Make a MULTI_SZ from a comma separated list */ for (size_t i = 0; i < domains_len; ++i) {