From: Matthias Andree Date: Thu, 3 Jun 2021 12:30:19 +0000 (+0200) Subject: Fix SIGSEGV (NULL deref) receiving push "echo" X-Git-Tag: v2.6_beta1~488 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0033811e0215af76f469d78912c95a2f59813454;p=thirdparty%2Fopenvpn.git Fix SIGSEGV (NULL deref) receiving push "echo" A server pushing "echo" without arguments can crash the client. In such a situation, the code in question receives p[1] == NULL (which was CLEAR(p)'ed above), hands it strncmp, which then dereferences the null pointer. Original report and analysis here: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=256331 Fixes: Trac #1409 Reported-by: peo@nethead.se (to FreeBSD) Signed-off-by: Matthias Andree Acked-by: Gert Doering Message-Id: <20210603123019.422644-1-matthias.andree@gmx.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22486.html Signed-off-by: Gert Doering --- diff --git a/src/openvpn/options.c b/src/openvpn/options.c index 8d4172063..a54bc562f 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -5365,7 +5365,7 @@ add_option(struct options *options, { /* only message-related ECHO are logged, since other ECHOs * can potentially include security-sensitive strings */ - if (strncmp(p[1], "msg", 3) == 0) + if (p[1] && strncmp(p[1], "msg", 3) == 0) { msg(M_INFO, "%s:%s", pull_mode ? "ECHO-PULL" : "ECHO",