cron2 has submitted this change. ( http://gerrit.openvpn.net/c/openvpn/+/1789?usp=email )
Change subject: proto: correct 802.1Q length check in is_ipv_X ...................................................................... proto: correct 802.1Q length check in is_ipv_X Github: OpenVPN/openvpn#1044 This has also been reported twice as a security relevant bug, but only later than the original finding - and it isn't. While --client-nat would modify a 32bit integer "after the packet" (the place where an IPv4 address would be, in a well-formed packet), the underlying buffer is always max-frame sized, and we never look at the "modified integer" afterwards, so there are no consequences warranting allocation of a CVE ID. Signed-off-by: rootvector2 <[email protected]> Acked-by: Arne Schwabe <[email protected]> Acked-by: Antonio Quartulli <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1789 Reported-By: 章鱼哥 (www.aipyaipy.com) Reported-By: Yu Zhang Wong <[email protected]> Change-Id: I8219c6295acf28ff10ddb2fcc285f813c42fa8fe Message-Id: <[email protected]> URL: https://www.mail-archive.com/[email protected]/msg37652.html Signed-off-by: Gert Doering <[email protected]> --- M src/openvpn/proto.c 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/openvpn/proto.c b/src/openvpn/proto.c index 13fe0a5..785c021 100644 --- a/src/openvpn/proto.c +++ b/src/openvpn/proto.c @@ -70,7 +70,7 @@ if (proto == htons(OPENVPN_ETH_P_8021Q)) { const struct openvpn_8021qhdr *evh; - if (BLENZ(buf) < sizeof(struct openvpn_ethhdr) + sizeof(struct openvpn_iphdr)) + if (BLENZ(buf) < sizeof(struct openvpn_8021qhdr) + sizeof(struct openvpn_iphdr)) { return false; } -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1789?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I8219c6295acf28ff10ddb2fcc285f813c42fa8fe Gerrit-Change-Number: 1789 Gerrit-PatchSet: 3 Gerrit-Owner: cron2 <[email protected]> Gerrit-Reviewer: ordex <[email protected]> Gerrit-Reviewer: plaisthos <[email protected]> Gerrit-CC: flichtenheld <[email protected]> Gerrit-CC: openvpn-devel <[email protected]>
_______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
