[XS] Change in openvpn[master]: openvpnserv: harden CheckConfigPath() a bit more

Attention is currently required from: d12fk, plaisthos.

Hello plaisthos,

I'd like you to do a code review.
Please visit

    http://gerrit.openvpn.net/c/openvpn/+/1886?usp=email

to review the following change.


Change subject: openvpnserv: harden CheckConfigPath() a bit more
......................................................................

openvpnserv: harden CheckConfigPath() a bit more

If the config_path retrieved from the Registry doesn't end with a path
sepatator, the prefix check could be satisfied by a sibling directory
that starts with the same substring, e.g. "config" vs. "configx". While
code in common.c ensures this, that code could disappear in the future
leaving the check vulnerable. Instead spend the few CPU cycles to be
absolutely sure, we're doing the right thing here.

Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.
Contributing Researcher: Vivek Parikh.

Reported-by: Vivek Parikh <[email protected]>
CVE: 2026-78043
Change-Id: Ic983a3bf1ee8d4ef98f3883d5e5ddf234696a182
Signed-off-by: Heiko Hund <[email protected]>
---
M src/openvpnserv/validate.c
1 file changed, 7 insertions(+), 1 deletion(-)



  git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/86/1886/1

diff --git a/src/openvpnserv/validate.c b/src/openvpnserv/validate.c
index e3ef8b6..8e529b9 100644
--- a/src/openvpnserv/validate.c
+++ b/src/openvpnserv/validate.c
@@ -62,7 +62,13 @@
 {
     HRESULT res;
     WCHAR config_path[MAX_PATH];
+    const size_t config_dir_len = wcslen(s->config_dir);
 
+    /* config_dir must end with a '\' or the prefix check below could be satisfied by a sibling directory */
+    if (config_dir_len == 0 || s->config_dir[config_dir_len - 1] != L'\\')
+    {
+        return FALSE;
+    }
     /* fname = stdin is special: do not treat it as a relative path */
     if (wcscmp(fname, L"stdin") == 0)
     {
@@ -83,7 +89,7 @@
         res = PathCchCanonicalize(config_path, _countof(config_path), fname);
     }
 
-    return res == S_OK && wcsnicmp(config_path, s->config_dir, wcslen(s->config_dir)) == 0;
+    return res == S_OK && wcsnicmp(config_path, s->config_dir, config_dir_len) == 0;
 }
 
 

-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1886?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: newchange
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Ic983a3bf1ee8d4ef98f3883d5e5ddf234696a182
Gerrit-Change-Number: 1886
Gerrit-PatchSet: 1
Gerrit-Owner: cron2 <[email protected]>
Gerrit-Reviewer: d12fk <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: plaisthos <[email protected]>
Gerrit-Attention: d12fk <[email protected]>

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel