From patchwork Mon Aug 31 18:47:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5305 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:c317:b0:87d:ab56:3700 with SMTP id jk23csp3570877mab; Mon, 31 Aug 2026 11:47:47 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RpLqyCKcwQZdSN+2rTdkXoQv/i16O58ggOJiRFyuU9L93dO46/48e8FCMTYneOwOjkOrTyzttTT5eA=@openvpn.net X-Received: by 2002:a05:6830:67f8:b0:7dc:e37b:b5d3 with SMTP id 46e09a7af769-7f4f227d276mr36434610a34.7.1788202066861; Mon, 31 Aug 2026 11:47:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1788202066; cv=none; d=google.com; s=arc-20260327; b=HPJwvvf1ZCZdtt7QJn6JdW9Bw6Jnzg/pG+eF3GjDI6U4EGvdIqza0mxvscqAp/5Pfs neRBW/vfgFEn8EOuP/Zx6A+IYbsSwft3snNycnUJ1pQMur+uWSFnkYvc3CmYZwKqUVxR f1xvys8RqE32WIoL4203x+Q36l5Cjr6wr5gVBSygJQ4GVvOT1kRiNfpwD3twFeidSTtk kA1tfLkVAJs/9Jcc5YoS0MJDSSY8n/rfCvfN2BqBmnVNk1+TH1gYaGyVirHv0qtYUvN/ ectYhyK8ljPqhz9FjqerPAKwPaYv0P+JLOvn5RZOQ7CHBeq+/DRSuAaz0T5jngXbxtuE 4BMg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=wiahpgtpEzFghRW7VAYO3kcCwauNWGi7VtSHiF392vk=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=RYEfmx1TvN7Lqaz2iP/MyCoK6FGbznWKbfDk+64ib6Kbzr5iC4d23HAxxJihEr+5FJ gitQI5NWy5DJ5inAOKNLOIIwWZrnWgmn/EQ4i8ggUl53QV5tAhHB6j3fqckwCxziK2nW rxB0tktvcBU2p4zm/CLSRQyBZ1kfGVy2Uit5C9nMEEpb6Bn3xlow47ZAfdpHJXKLRDB2 p1jVvbm69kNA/KITaK1v2VR1W8JxVZytQWkjl6xz6Wyj03lq6gJNxLrJVDAn/zJoFQeC ++z7D/QSrggEflHfhHolOVy/x6M+DEC9AT+l8jEa42QW5MPmdE9IRe2875E8fTaKFHw1 rOOA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=WDZrwvUP; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ho86e1+B; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=aLoJaGVp; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 46e09a7af769-7f65d4c69f3si9384772a34.107.2026.08.31.11.47.46 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 31 Aug 2026 11:47:46 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=WDZrwvUP; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ho86e1+B; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=aLoJaGVp; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=wiahpgtpEzFghRW7VAYO3kcCwauNWGi7VtSHiF392vk=; b=WDZrwvUPcVXg+7MLG6MLqE0tqM /VAfb+AZEjg0FSkSB6PQyYWJbi7gD4w8gChYKnVKKXo1T8rtSnLkcFtFYNPC9OGiWKCp4JtQ4toxV 9XDMIgnInT6ofixwZfY0P8SuTS+xCsKIlX2nVEXHnnqTvYa41Pfcv5h7VUqrfOBx2kT8=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1x172k-0005Dn-Fk; Mon, 31 Aug 2026 18:47:43 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1x172j-0005Da-M4 for openvpn-devel@lists.sourceforge.net; Mon, 31 Aug 2026 18:47:42 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=IbST3yRHxo4JFtuKJga9fthHyreHuyfMJ27tE1h61sQ=; b=ho86e1+BNklO6HhDjOHedw+AAL klj21bMb+eC8OWIUtX34yG7V5gmgITIOgbLuuctv+qBXxDXge/8SUJM3bWP2XwivPT9L8bRrxgIv2 KGK6zRmwxAWeN5l52MBltpns3fM0Lms210WzIvsVm2EDLWsX+aoUzxLbO0Q+2vCV6n1g=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=IbST3yRHxo4JFtuKJga9fthHyreHuyfMJ27tE1h61sQ=; b=aLoJaGVpNX8ggYfetkGjNb/9xb eaGWLG9M+vBo3tP033JnpmP+qCZQ9Df98t2wQq0nmb8qJoVDkchCq5HJjT/W6F0tzLHpoa8DcF1Pr NdFZa+YyuLUtrAx2B/Jpiqu8cjaneNWh3obQQhAf2QODmTjeaubMMwA23s4qFoLYy8y8=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1x172h-0004C2-Oq for openvpn-devel@lists.sourceforge.net; Mon, 31 Aug 2026 18:47:42 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 67VIlXO0003435 for ; Mon, 31 Aug 2026 20:47:33 +0200 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 67VIlX5V003434 for openvpn-devel@lists.sourceforge.net; Mon, 31 Aug 2026 20:47:33 +0200 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Mon, 31 Aug 2026 20:47:26 +0200 Message-ID: <20260831184732.3417-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.53.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Heiko Hund Code checked for a hypothetical third trailing NUL character, instead of the second. Could read one extra octet beyond the buffer if it is used up by the data completely. Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1x172h-0004C2-Oq Subject: [Openvpn-devel] [PATCH v1] openvpnserv: fix off-by-one input validation X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1875065770016949307 X-GMAIL-MSGID: 1875065770016949307 From: Heiko Hund Code checked for a hypothetical third trailing NUL character, instead of the second. Could read one extra octet beyond the buffer if it is used up by the data completely. Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2. Contributing Researcher: Vivek Parikh. Reported-by: Vivek Parikh CVE: 2026-78221 Change-Id: I1a181d65ad0d5e3765f57373a6ee223ede909dea Signed-off-by: Heiko Hund Acked-by: Razvan Cojocaru Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1888 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1888 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c index 0c6e23f..d2288b9 100644 --- a/src/openvpnserv/interactive.c +++ b/src/openvpnserv/interactive.c @@ -2959,7 +2959,7 @@ const char *rdom = msg->resolve_domains; size_t rdom_size = sizeof(msg->resolve_domains); size_t rdom_len = strlen(rdom); - if (rdom_len && (rdom_len + 1 >= rdom_size || rdom[rdom_len + 2] != 0)) + if (rdom_len && (rdom_len + 1 >= rdom_size || rdom[rdom_len + 1] != 0)) { return ERROR_MESSAGE_DATA; }