From 007738e9d6030c8989713543e4f7308ff57be30f Mon Sep 17 00:00:00 2001 From: James Yonan Date: Thu, 3 Mar 2016 00:48:12 -0700 Subject: [PATCH] Fixed port-share bug with DoS potential Fixed port-share bug that can cause segfault when the number of concurrent connections is large. The issue is that the port-share code calls openvpn_connect() which in turn calls select(). When there are a high number of concurrent port-share connections, the fd passed to select can potentially exceed FD_SETSIZE, causing undefined behavior. The fix is to use poll() (if available) instead of select(). Signed-off-by: James Yonan Acked-by: Steffan Karger Acked-by: Gert Doering Message-Id: URL: http://article.gmane.org/gmane.network.openvpn.devel/11626 Signed-off-by: Gert Doering --- src/openvpn/socket.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/openvpn/socket.c b/src/openvpn/socket.c index 9bcf4d439..f7264ef62 100644 --- a/src/openvpn/socket.c +++ b/src/openvpn/socket.c @@ -1149,6 +1149,12 @@ openvpn_connect (socket_descriptor_t sd, { while (true) { +#if POLL + struct pollfd fds[1]; + fds[0].fd = sd; + fds[0].events = POLLOUT; + status = poll(fds, 1, 0); +#else fd_set writes; struct timeval tv; @@ -1158,7 +1164,7 @@ openvpn_connect (socket_descriptor_t sd, tv.tv_usec = 0; status = select (sd + 1, NULL, &writes, NULL, &tv); - +#endif if (signal_received) { get_signal (signal_received); -- 2.47.2