[XS] Change in openvpn[master]: openvpnserv: pass correct NRPT domains size

cron2 has submitted this change. ( http://gerrit.openvpn.net/c/openvpn/+/1887?usp=email )

Change subject: openvpnserv: pass correct NRPT domains size
......................................................................

openvpnserv: pass correct NRPT domains size

Previous code assumed that the input NRPT domains list consisted of
ASCII characters only. When IDNs were passed as UTF-8 the size of the
converted wide character MULTI_SZ list was calculated wrong, leading to
extra data being read and stored in the Registry.

Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.
Contributing Researcher: Vivek Parikh.

Reported-by: Vivek Parikh <[email protected]>
Tested-by: Vivek Parikh <[email protected]>
CVE: 2026-78221
Github: openvpn/openvpn-private-issues#162
Change-Id: I9ee4b6d1c21bec3873dc6a474bd65d043b5370c8
Signed-off-by: Heiko Hund <[email protected]>
Acked-by: Razvan Cojocaru <[email protected]>
Acked-by: Arne Schwabe <[email protected]>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1887
Message-Id: <[email protected]>
URL: https://www.mail-archive.com/[email protected]/msg38853.html
Signed-off-by: Gert Doering <[email protected]>
---
M src/openvpnserv/interactive.c
1 file changed, 3 insertions(+), 1 deletion(-)




diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c
index 36dfb8e..0c6e23f 100644
--- a/src/openvpnserv/interactive.c
+++ b/src/openvpnserv/interactive.c
@@ -2735,11 +2735,13 @@
         dom_size = (DWORD)domains_len + 2; /* len + the trailing NULs */
 
         wide_domains = utf8to16_size(domains, dom_size);
-        dom_size *= sizeof(*wide_domains);
         if (!wide_domains)
         {
             return ERROR_OUTOFMEMORY;
         }
+        domains_len = wcslen(wide_domains);
+        dom_size = (DWORD)(domains_len + 2) * sizeof(*wide_domains);
+
         /* Make a MULTI_SZ from a comma separated list */
         for (size_t i = 0; i < domains_len; ++i)
         {

-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1887?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: merged
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I9ee4b6d1c21bec3873dc6a474bd65d043b5370c8
Gerrit-Change-Number: 1887
Gerrit-PatchSet: 2
Gerrit-Owner: cron2 <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-Reviewer: razvanc <[email protected]>
Gerrit-CC: d12fk <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel