Re: [PATCH applied] Re: options: fix use-after-free of DNS options on client connect

Gert Doering <[email protected]> Tue, 23 Jun 2026 11:36:52 +0200

Newsgroups	gmane.network.openvpn.devel
Message-ID	<[email protected]>

Hi,

On Mon, Jun 22, 2026 at 04:41:31PM +0200, Gert Doering wrote:
> Thanks for digging into this, and thanks Arne for the review - all these
> GC-and-option-copy-magic is not exactly where I feel safe.  Anyway, this
> said, I can confirm that it fixed the issue on OpenBSD, and passes my
> t_server setup (which has multiple clients connecting...) just fine.
> 
> Your patch has been applied to the master and release/2.7 branch (bugfix).
> 
> The offending code is quite different in 2.6 (no copying around of
> DNS and DHCP options) so I think the bugfix is not needed - at least I could
> not reproduce the double-free()-assert on OpenBSD.

As it turns out, the bug is in 2.6 as well, and it can be reproduced
there as well, but needs different config ("dns" instead of "dhcp-option"
in the server config).  Crash without the patch, no crash with the patch.

> commit 97ec63372ab354ad48c89e73d1e37715679370ba (master)
> commit 40a3bc951f64c6afe69c55afff9ff7a855b69097 (release/2.7)

commit 14d761c8bedde3fd7c45e355556ed8a1883f9ca7 (release/2.6)

gert
-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             [email protected]

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

signature.asc (application/pgp-signature, 659 B)