From: James Yonan <james@openvpn.net>
Date: Thu, 3 Mar 2016 07:48:12 +0000 (-0700)
Subject: Fixed port-share bug with DoS potential
X-Git-Tag: v2.4_alpha1~95
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=007738e9d6030c8989713543e4f7308ff57be30f;p=thirdparty%2Fopenvpn.git

Fixed port-share bug with DoS potential

Fixed port-share bug that can cause segfault when the number
of concurrent connections is large.

The issue is that the port-share code calls openvpn_connect()
which in turn calls select().  When there are a high number
of concurrent port-share connections, the fd passed to select
can potentially exceed FD_SETSIZE, causing undefined behavior.

The fix is to use poll() (if available) instead of select().

Signed-off-by: James Yonan <james@openvpn.net>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <CAA1Abx+2E2FZN-y6P=mkKpSuZ7bOV5m6rUMTx3V7UP2qPMjZPg@mail.gmail.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/11626
Signed-off-by: Gert Doering <gert@greenie.muc.de>
---

diff --git a/src/openvpn/socket.c b/src/openvpn/socket.c
index 9bcf4d439..f7264ef62 100644
--- a/src/openvpn/socket.c
+++ b/src/openvpn/socket.c
@@ -1149,6 +1149,12 @@ openvpn_connect (socket_descriptor_t sd,
     {
       while (true)
 	{
+#if POLL
+	  struct pollfd fds[1];
+	  fds[0].fd = sd;
+	  fds[0].events = POLLOUT;
+	  status = poll(fds, 1, 0);
+#else
 	  fd_set writes;
 	  struct timeval tv;
 
@@ -1158,7 +1164,7 @@ openvpn_connect (socket_descriptor_t sd,
 	  tv.tv_usec = 0;
 
 	  status = select (sd + 1, NULL, &writes, NULL, &tv);
-
+#endif
 	  if (signal_received)
 	    {
 	      get_signal (signal_received);