Skip to contentSkip to conversation

Avoid illegal memory access when malformed data is read from the pipe

PATCH In review [email protected]... 2 participants 3 messages Oct 20, 2017 – Nov 3, 2017

lore
Share & tools
lore

[email protected]...

author
#0 lore raw

PATCH 1/1 Avoid illegal memory access when malformed data is read from the pipe

From: Selva Nair <[email protected]...>

- If only 1 byte is read from the interactive service client pipe, that evaluates to zero wide characters and subsequent check for NUL termination in the data buffer segfaults.
Fix: reject clients that send less than a complete wide character.

Signed-off-by Selva Nair <[email protected]...>
---
 src/openvpnserv/interactive.c | 7 +++++++
 1 file changed, 7 insertions(+)
src/openvpnserv/interactive.c +7 -0
index f3be113..0d162e8 100644
@@ -466,6 +466,13 @@ GetStartupData(HANDLE pipe, STARTUP_DATA *sud)
     }
 
     size = bytes / sizeof(*data);
+    if (size == 0)
+    {
+        MsgToEventLog(M_SYSERR, TEXT("malformed startup data: 1 byte received"));
+        ReturnError(pipe, ERROR_STARTUP_DATA, L"GetStartupData", 1, &exit_event);
+        goto out;
+    }
+
     data = malloc(bytes);
     if (data == NULL)
     {
Signature · 1 line
2.6.2
#1 lore raw

Hi,

Quoted 6 lines · On Fri, Oct 20, 2017 at 01:25:56PM -0400, [email protected]... wrote:

From: Selva Nair <[email protected]...>

- If only 1 byte is read from the interactive service client pipe, that evaluates to zero wide characters and subsequent check for NUL termination in the data buffer segfaults.
Fix: reject clients that send less than a complete wide character.

ACK.

(Not merging right now due to time constraints, but the patch does what it says on the lid - thanks)

gert

Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...
#2 lore raw
In reply to [email protected]...

ACK, and now with time to merge :-)

Your patch has been applied to the master and release/2.4 branch.

commit 6f20808c8f37301c43d822f6a22d30b3587abc57 (master) commit 17884fa4ab2b3113559542404704402e5fce7643 (release/2.4)

Author: Selva Nair
Date:   Fri Oct 20 13:25:56 2017 -0400
     Avoid illegal memory access when malformed data is read from the pipe

     Signed-off-by: Selva Nair <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg15657.html
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering