diff mbox series

[Openvpn-devel,v1] interactive: null-terminate iface.name in address and route handlers

Message ID 20261021165735.11175-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] interactive: null-terminate iface.name in address and route handlers |

Commit Message

Gert Doering Oct. 21, 2026, 4:57 p.m. UTC 
  From: Naveed Khan <dxbnaveed.k@gmail.com>

HandleAddressMessage() and HandleRouteMessage() pass the client supplied
interface name to InterfaceLuid() and strlen() without making sure it is
null-terminated. A pipe client sending a message with iface.index set to
TUN_ADAPTER_INDEX_INVALID and a 256 byte name without a terminating NUL
makes the service read past the name into the remainder of the on-stack
pipe_message_t and beyond.

This is hardening rather than a fix for an exploitable bug: the trailing
bytes only ever reach ConvertInterfaceAliasToLuid(), which fails on them,
and nothing is returned to the client beyond an error code. Terminate the
name anyway, like HandleDNSConfigMessage() and HandleDNSConfigNrptMessage()
already do.

Github: OpenVPN/openvpn#1130
Change-Id: I26fe14053446dbd215f947910565c20318c34627
Signed-off-by: Naveed Khan <dxbnaveed.k@gmail.com>
Signed-off-by: Lev Stipakov <lev@openvpn.net>
Acked-by: Heiko Hund <heiko@openvpn.net>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2027
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2027
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Heiko Hund <heiko@openvpn.net>
diff mbox series

Patch

diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c
index ed163a4..d36e8d5 100644
--- a/src/openvpnserv/interactive.c
+++ b/src/openvpnserv/interactive.c
@@ -575,6 +575,9 @@ 
     PMIB_UNICASTIPADDRESS_ROW addr_row;
     BOOL add = msg->header.type == msg_add_address;
 
+    /* enforce null-termination of the interface name from client */
+    msg->iface.name[_countof(msg->iface.name) - 1] = '\0';
+
     addr_row = malloc(sizeof(*addr_row));
     if (addr_row == NULL)
     {
@@ -653,6 +656,9 @@ 
     PMIB_IPFORWARD_ROW2 fwd_row;
     BOOL add = msg->header.type == msg_add_route;
 
+    /* enforce null-termination of the interface name from client */
+    msg->iface.name[_countof(msg->iface.name) - 1] = '\0';
+
     fwd_row = malloc(sizeof(*fwd_row));
     if (fwd_row == NULL)
     {