diff mbox series

[Openvpn-devel,v1] interactive: validate message size for dns/nrpt/wins handlers

Message ID 20261023185614.5201-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] interactive: validate message size for dns/nrpt/wins handlers |

Commit Message

Gert Doering Oct. 23, 2026, 6:56 p.m. UTC 
  From: Naveed Khan <dxbnaveed.k@gmail.com>

HandleMessage() dispatches every fixed-size request only after checking
that msg.header.size equals the size of the expected struct: address,
route, flush_neighbors, wfp_block, enable_dhcp, set_mtu and
create_adapter all do this. The dns, nrpt and wins config handlers do
not, so they inherit only the generic gate (header.size <= sizeof the
message union).

The stack message object is not zeroed, so an unprivileged pipe client
can send an undersized dns/nrpt/wins message and have the service act on
uninitialized stack memory: addr_len, the address array, family, the
interface name and the domain lists are all read beyond the bytes that
were actually received. The service runs as SYSTEM and takes these
messages from any local user, so it should apply the same size check the
other handlers already use.

Add the matching msg.header.size == sizeof(...) check to the dns,
nrpt_dns and wins cases.

Acked-by: Heiko Hund <heiko@ist.eigentlich.net>
Change-Id: I0083c6c5460ff2aff638598ac26f99fd30d01fd1
Signed-off-by: Naveed Khan <dxbnaveed.k@gmail.com>
Acked-by: Heiko Hund <heiko@openvpn.net>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2030
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2030
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Heiko Hund <heiko@openvpn.net>
diff mbox series

Patch

diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c
index d36e8d5..e8203c6e 100644
--- a/src/openvpnserv/interactive.c
+++ b/src/openvpnserv/interactive.c
@@ -3292,20 +3292,27 @@ 
 
         case msg_add_dns_cfg:
         case msg_del_dns_cfg:
-            ack.error_number = HandleDNSConfigMessage(&msg.dns, lists);
+            if (msg.header.size == sizeof(msg.dns))
+            {
+                ack.error_number = HandleDNSConfigMessage(&msg.dns, lists);
+            }
             break;
 
         case msg_add_nrpt_cfg:
         case msg_del_nrpt_cfg:
-        {
-            DWORD ovpn_pid = proc_info->dwProcessId;
-            ack.error_number = HandleDNSConfigNrptMessage(&msg.nrpt_dns, ovpn_pid, lists);
-        }
-        break;
+            if (msg.header.size == sizeof(msg.nrpt_dns))
+            {
+                DWORD ovpn_pid = proc_info->dwProcessId;
+                ack.error_number = HandleDNSConfigNrptMessage(&msg.nrpt_dns, ovpn_pid, lists);
+            }
+            break;
 
         case msg_add_wins_cfg:
         case msg_del_wins_cfg:
-            ack.error_number = HandleWINSConfigMessage(&msg.wins, lists);
+            if (msg.header.size == sizeof(msg.wins))
+            {
+                ack.error_number = HandleWINSConfigMessage(&msg.wins, lists);
+            }
             break;
 
         case msg_enable_dhcp: