From: Matthias Andree Date: Thu, 3 Jun 2021 12:30:19 +0000 (+0200) Subject: Fix SIGSEGV (NULL deref) receiving push "echo" X-Git-Tag: v2.5.3~14 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d6e21bed964109abaf4bf03a951dc2fc9b1d5c1f;p=thirdparty%2Fopenvpn.git Fix SIGSEGV (NULL deref) receiving push "echo" A server pushing "echo" without arguments can crash the client. In such a situation, the code in question receives p[1] == NULL (which was CLEAR(p)'ed above), hands it strncmp, which then dereferences the null pointer. Original report and analysis here: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=256331 Fixes: Trac #1409 Reported-by: peo@nethead.se (to FreeBSD) Signed-off-by: Matthias Andree Acked-by: Gert Doering Message-Id: <20210603123019.422644-1-matthias.andree@gmx.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22486.html Signed-off-by: Gert Doering (cherry picked from commit 0033811e0215af76f469d78912c95a2f59813454) --- diff --git a/src/openvpn/options.c b/src/openvpn/options.c index 1f6a8b8a2..24df30d38 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -5319,7 +5319,7 @@ add_option(struct options *options, { /* only message-related ECHO are logged, since other ECHOs * can potentially include security-sensitive strings */ - if (strncmp(p[1], "msg", 3) == 0) + if (p[1] && strncmp(p[1], "msg", 3) == 0) { msg(M_INFO, "%s:%s", pull_mode ? "ECHO-PULL" : "ECHO",