diff mbox series

[Openvpn-devel,v1] openvpnserv: free security descriptors in RunOpenvpn()

Message ID 20261104074751.21336-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] openvpnserv: free security descriptors in RunOpenvpn() |

Commit Message

Gert Doering Nov. 4, 2026, 7:47 a.m. UTC 
  From: Razvan Cojocaru <razvanc@mailbox.org>

The DACL from SetEntriesInAcl() and the pipe security descriptor from
ConvertStringSecurityDescriptorToSecurityDescriptorW() were never
freed, leaking both on every client connection. Initialize them to
NULL at the top and LocalFree() them at out.

DACL leaked since a24dd2e3 ("interactive service v3"), pipe security
descriptor since 0a429cb1 ("Restrict access to the service pipe to
SYSTEM and owner").

Change-Id: Ifc707ef69d614c3408b6f88c780e337e95baafac
Signed-off-by: Razvan Cojocaru <razvanc@mailbox.org>
Acked-by: Heiko Hund <heiko@openvpn.net>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2111
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2111
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Heiko Hund <heiko@openvpn.net>
diff mbox series

Patch

diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c
index 484f27c..4ddc354 100644
--- a/src/openvpnserv/interactive.c
+++ b/src/openvpnserv/interactive.c
@@ -3444,7 +3444,8 @@ 
                                         .lpSecurityDescriptor = NULL,
                                         .bInheritHandle = TRUE };
 
-    PACL ovpn_dacl;
+    PACL ovpn_dacl = NULL;
+    PSECURITY_DESCRIPTOR pSD = NULL;
     EXPLICIT_ACCESS ea[2];
     SECURITY_DESCRIPTOR ovpn_sd;
     SECURITY_ATTRIBUTES ovpn_sa = { .nLength = sizeof(ovpn_sa),
@@ -3624,7 +3625,6 @@ 
      */
 
     SECURITY_ATTRIBUTES sa;
-    PSECURITY_DESCRIPTOR pSD = NULL;
     LPCWSTR szSDDL = L"D:(A;;GA;;;SY)(A;;GA;;;OW)";
     if (!ConvertStringSecurityDescriptorToSecurityDescriptorW(
             szSDDL, SDDL_REVISION_1, &pSD, NULL))
@@ -3764,6 +3764,8 @@ 
     free(ovpn_user);
     free(svc_user);
     free(cmdline);
+    LocalFree(pSD);
+    LocalFree(ovpn_dacl);
     DestroyEnvironmentBlock(user_env);
     FreeStartupData(&sud);
     CloseHandleEx(&proc_info.hProcess);