[XS] Change in openvpn[master]: proto: correct 802.1Q length check in is_ipv_X

Hello ordex, plaisthos, 

I'd like you to reexamine a change. Please visit

    http://gerrit.openvpn.net/c/openvpn/+/1789?usp=email

to look at the new patch set (#3).

The following approvals got outdated and were removed:
Code-Review+2 by ordex, Code-Review+2 by plaisthos


Change subject: proto: correct 802.1Q length check in is_ipv_X
......................................................................

proto: correct 802.1Q length check in is_ipv_X

Github: OpenVPN/openvpn#1044

This has also been reported twice as a security relevant bug, but
only later than the original finding - and it isn't.

While --client-nat would modify a 32bit integer "after the packet"
(the place where an IPv4 address would be, in a well-formed packet),
the underlying buffer is always max-frame sized, and we never look
at the "modified integer" afterwards, so there are no consequences
warranting allocation of a CVE ID.

Signed-off-by: rootvector2 <[email protected]>
Acked-by: Arne Schwabe <[email protected]>
Acked-by: Antonio Quartulli <[email protected]>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1789
Reported-By: 章鱼哥 (www.aipyaipy.com)
Reported-By: Yu Zhang Wong <[email protected]>
Change-Id: I8219c6295acf28ff10ddb2fcc285f813c42fa8fe
Message-Id: <[email protected]>
URL: https://www.mail-archive.com/[email protected]/msg37652.html
Signed-off-by: Gert Doering <[email protected]>
---
M src/openvpn/proto.c
1 file changed, 1 insertion(+), 1 deletion(-)


  git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/89/1789/3

diff --git a/src/openvpn/proto.c b/src/openvpn/proto.c
index 13fe0a5..785c021 100644
--- a/src/openvpn/proto.c
+++ b/src/openvpn/proto.c
@@ -70,7 +70,7 @@
         if (proto == htons(OPENVPN_ETH_P_8021Q))
         {
             const struct openvpn_8021qhdr *evh;
-            if (BLENZ(buf) < sizeof(struct openvpn_ethhdr) + sizeof(struct openvpn_iphdr))
+            if (BLENZ(buf) < sizeof(struct openvpn_8021qhdr) + sizeof(struct openvpn_iphdr))
             {
                 return false;
             }

-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1789?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I8219c6295acf28ff10ddb2fcc285f813c42fa8fe
Gerrit-Change-Number: 1789
Gerrit-PatchSet: 3
Gerrit-Owner: cron2 <[email protected]>
Gerrit-Reviewer: ordex <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-CC: flichtenheld <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel