]> git.ipfire.org Git - thirdparty/openvpn.git/commit
Fix possible heap overflow on read accessing getaddrinfo() result.
authorGert Doering <gert@greenie.muc.de>
Tue, 10 Nov 2015 21:58:39 +0000 (22:58 +0100)
committerGert Doering <gert@greenie.muc.de>
Wed, 11 Nov 2015 07:46:54 +0000 (08:46 +0100)
commitcdbadd00582af84aa8adf588743eec8d01910a0b
treeb2674cafb9fcdd3528941e5d277eb464644960eb
parent3254099bc4c88315352457b4efb067587df29a77
Fix possible heap overflow on read accessing getaddrinfo() result.

The code always tried to copy-out a "struct sockaddr_in6" even for IPv4
results, which reads more bytes than getaddrinfo() is guaranteed to
allocate.

Now, look at ai->ai_family and only copy "struct sockaddr" for IPv4.

Also, reformat this block of code to comply to coding style.

This is a specific 2.3 bug as the code in master (to be 2.4) has been
completely rewritten to properly handle dual-stack and multiple responses
from getaddrinfo() proper.

Bug found by Daniel Hirche using "gcc -fsanitize=address".  No possible
exploits are known.

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <1447192719-31381-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/10479
src/openvpn/socket.c