From 37af2c953266a3ffd34b3fa95317bd995e985aec Mon Sep 17 00:00:00 2001 From: Lev Stipakov Date: Thu, 30 Oct 2025 16:04:26 +0100 Subject: [PATCH] interactive.c: add the upper bound for startupdata size The size is passed from the limited-privileges process. This check ensures that the service won't allocate more than needed. Reported-by: Joshua Rogers Found-by: ZeroPath (https://zeropath.com/) Change-Id: I75ebf01641db4dcd07041e3b8b3fa8a632d07595 Signed-off-by: Lev Stipakov Acked-by: Gert Doering Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1331 Message-Id: <20251030150432.4689-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg34039.html Signed-off-by: Gert Doering --- src/openvpnserv/interactive.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c index ce0d4dd15..cb3126781 100644 --- a/src/openvpnserv/interactive.c +++ b/src/openvpnserv/interactive.c @@ -446,9 +446,9 @@ GetStartupData(HANDLE pipe, STARTUP_DATA *sud) } size = bytes / sizeof(*data); - if (size == 0) + if ((size == 0) || (size > 4096)) /* our startup data is 1024 wchars at the moment */ { - MsgToEventLog(M_SYSERR, L"malformed startup data: 1 byte received"); + MsgToEventLog(M_SYSERR, L"malformed startup data: %lu bytes received", size); ReturnError(pipe, ERROR_STARTUP_DATA, L"GetStartupData", 1, &exit_event); goto err; } -- 2.47.3