[PATCH v1] openvpnserv: harden CheckConfigPath() a bit more

From: Heiko Hund <[email protected]>

If the config_path retrieved from the Registry doesn't end with a path
sepatator, the prefix check could be satisfied by a sibling directory
that starts with the same substring, e.g. "config" vs. "configx". While
code in common.c ensures this, that code could disappear in the future
leaving the check vulnerable. Instead spend the few CPU cycles to be
absolutely sure, we're doing the right thing here.

Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.
Contributing Researcher: Vivek Parikh.

Reported-by: Vivek Parikh <[email protected]>
CVE: 2026-78043
Change-Id: Ic983a3bf1ee8d4ef98f3883d5e5ddf234696a182
Signed-off-by: Heiko Hund <[email protected]>
Acked-by: Razvan Cojocaru <[email protected]>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1886
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1886
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Razvan Cojocaru <[email protected]>

        
diff --git a/src/openvpnserv/validate.c b/src/openvpnserv/validate.c
index e3ef8b6..8e529b9 100644
--- a/src/openvpnserv/validate.c
+++ b/src/openvpnserv/validate.c
@@ -62,7 +62,13 @@
 {
     HRESULT res;
     WCHAR config_path[MAX_PATH];
+    const size_t config_dir_len = wcslen(s->config_dir);
 
+    /* config_dir must end with a '\' or the prefix check below could be satisfied by a sibling directory */
+    if (config_dir_len == 0 || s->config_dir[config_dir_len - 1] != L'\\')
+    {
+        return FALSE;
+    }
     /* fname = stdin is special: do not treat it as a relative path */
     if (wcscmp(fname, L"stdin") == 0)
     {
@@ -83,7 +89,7 @@
         res = PathCchCanonicalize(config_path, _countof(config_path), fname);
     }
 
-    return res == S_OK && wcsnicmp(config_path, s->config_dir, wcslen(s->config_dir)) == 0;
+    return res == S_OK && wcsnicmp(config_path, s->config_dir, config_dir_len) == 0;
 }