[PATCH v1] openvpnserv: pass correct NRPT domains size

From: Heiko Hund <[email protected]>

Previous code assumed that the input NRPT domains list consisted of
ASCII characters only. When IDNs were passed as UTF-8 the size of the
converted wide character MULTI_SZ list was calculated wrong, leading to
extra data being read and stored in the Registry.

Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.
Contributing Researcher: Vivek Parikh.

Reported-by: Vivek Parikh <[email protected]>
CVE: 2026-78221
Github: openvpn/openvpn-private-issues#162
Change-Id: I9ee4b6d1c21bec3873dc6a474bd65d043b5370c8
Signed-off-by: Heiko Hund <[email protected]>
Acked-by: Razvan Cojocaru <[email protected]>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1887
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1887
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Razvan Cojocaru <[email protected]>

        
diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c
index 36dfb8e..0c6e23f 100644
--- a/src/openvpnserv/interactive.c
+++ b/src/openvpnserv/interactive.c
@@ -2735,11 +2735,13 @@
         dom_size = (DWORD)domains_len + 2; /* len + the trailing NULs */
 
         wide_domains = utf8to16_size(domains, dom_size);
-        dom_size *= sizeof(*wide_domains);
         if (!wide_domains)
         {
             return ERROR_OUTOFMEMORY;
         }
+        domains_len = wcslen(wide_domains);
+        dom_size = (DWORD)(domains_len + 2) * sizeof(*wide_domains);
+
         /* Make a MULTI_SZ from a comma separated list */
         for (size_t i = 0; i < domains_len; ++i)
         {