mirror of
https://github.com/OpenVPN/openvpn.git
synced 2026-05-28 04:03:29 -04:00
Prevent crash on invalid server-ipv6 argument
Some checks are pending
Build / Check code style with Uncrustify (push) Waiting to run
Build / gcc-mingw - x64 - OSSL (push) Waiting to run
Build / gcc-mingw - x86 - OSSL (push) Waiting to run
Build / mingw unittest argv - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest auth_token - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest buffer - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest crypto - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest cryptoapi - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest misc - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest ncp - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest packet_id - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest pkt - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest provider - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest tls_crypt - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest argv - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest auth_token - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest buffer - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest crypto - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest cryptoapi - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest misc - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest ncp - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest packet_id - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest pkt - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest provider - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest tls_crypt - x86 - OSSL (push) Blocked by required conditions
Build / gcc - ubuntu-24.04 - OpenSSL 3.0.13 --enable-pkcs11 (push) Waiting to run
Build / gcc - ubuntu-22.04 - OpenSSL 3.0.2 --enable-pkcs11 (push) Waiting to run
Build / gcc - ubuntu-22.04 - mbed TLS 2.28.0 (push) Waiting to run
Build / clang-asan - ubuntu-22.04 - mbedtls (push) Waiting to run
Build / clang-asan - ubuntu-22.04 - openssl (push) Waiting to run
Build / clang-asan - ubuntu-24.04 - mbedtls (push) Waiting to run
Build / clang-asan - ubuntu-24.04 - openssl (push) Waiting to run
Build / macos-13 - libressl - asan (push) Waiting to run
Build / macos-13 - openssl@1.1 - asan (push) Waiting to run
Build / macos-13 - openssl@3 - asan (push) Waiting to run
Build / macos-14 - libressl - asan (push) Waiting to run
Build / macos-14 - openssl@1.1 - asan (push) Waiting to run
Build / macos-14 - openssl@3 - asan (push) Waiting to run
Build / macos-15 - libressl - asan (push) Waiting to run
Build / macos-15 - openssl@1.1 - asan (push) Waiting to run
Build / macos-15 - openssl@3 - asan (push) Waiting to run
Build / macos-13 - libressl - normal (push) Waiting to run
Build / macos-13 - openssl@1.1 - normal (push) Waiting to run
Build / macos-13 - openssl@3 - normal (push) Waiting to run
Build / macos-14 - libressl - normal (push) Waiting to run
Build / macos-14 - openssl@1.1 - normal (push) Waiting to run
Build / macos-14 - openssl@3 - normal (push) Waiting to run
Build / macos-15 - libressl - normal (push) Waiting to run
Build / macos-15 - openssl@1.1 - normal (push) Waiting to run
Build / macos-15 - openssl@3 - normal (push) Waiting to run
Build / msbuild - amd64 - openssl (push) Waiting to run
Build / msbuild - arm64 - openssl (push) Waiting to run
Build / msbuild - x86 - openssl (push) Waiting to run
Build / clang asan - ubuntu-22.04 - libressl (push) Waiting to run
Build / gcc normal - ubuntu-22.04 - libressl (push) Waiting to run
Some checks are pending
Build / Check code style with Uncrustify (push) Waiting to run
Build / gcc-mingw - x64 - OSSL (push) Waiting to run
Build / gcc-mingw - x86 - OSSL (push) Waiting to run
Build / mingw unittest argv - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest auth_token - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest buffer - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest crypto - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest cryptoapi - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest misc - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest ncp - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest packet_id - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest pkt - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest provider - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest tls_crypt - x64 - OSSL (push) Blocked by required conditions
Build / mingw unittest argv - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest auth_token - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest buffer - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest crypto - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest cryptoapi - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest misc - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest ncp - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest packet_id - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest pkt - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest provider - x86 - OSSL (push) Blocked by required conditions
Build / mingw unittest tls_crypt - x86 - OSSL (push) Blocked by required conditions
Build / gcc - ubuntu-24.04 - OpenSSL 3.0.13 --enable-pkcs11 (push) Waiting to run
Build / gcc - ubuntu-22.04 - OpenSSL 3.0.2 --enable-pkcs11 (push) Waiting to run
Build / gcc - ubuntu-22.04 - mbed TLS 2.28.0 (push) Waiting to run
Build / clang-asan - ubuntu-22.04 - mbedtls (push) Waiting to run
Build / clang-asan - ubuntu-22.04 - openssl (push) Waiting to run
Build / clang-asan - ubuntu-24.04 - mbedtls (push) Waiting to run
Build / clang-asan - ubuntu-24.04 - openssl (push) Waiting to run
Build / macos-13 - libressl - asan (push) Waiting to run
Build / macos-13 - openssl@1.1 - asan (push) Waiting to run
Build / macos-13 - openssl@3 - asan (push) Waiting to run
Build / macos-14 - libressl - asan (push) Waiting to run
Build / macos-14 - openssl@1.1 - asan (push) Waiting to run
Build / macos-14 - openssl@3 - asan (push) Waiting to run
Build / macos-15 - libressl - asan (push) Waiting to run
Build / macos-15 - openssl@1.1 - asan (push) Waiting to run
Build / macos-15 - openssl@3 - asan (push) Waiting to run
Build / macos-13 - libressl - normal (push) Waiting to run
Build / macos-13 - openssl@1.1 - normal (push) Waiting to run
Build / macos-13 - openssl@3 - normal (push) Waiting to run
Build / macos-14 - libressl - normal (push) Waiting to run
Build / macos-14 - openssl@1.1 - normal (push) Waiting to run
Build / macos-14 - openssl@3 - normal (push) Waiting to run
Build / macos-15 - libressl - normal (push) Waiting to run
Build / macos-15 - openssl@1.1 - normal (push) Waiting to run
Build / macos-15 - openssl@3 - normal (push) Waiting to run
Build / msbuild - amd64 - openssl (push) Waiting to run
Build / msbuild - arm64 - openssl (push) Waiting to run
Build / msbuild - x86 - openssl (push) Waiting to run
Build / clang asan - ubuntu-22.04 - libressl (push) Waiting to run
Build / gcc normal - ubuntu-22.04 - libressl (push) Waiting to run
`get_addr_generic()` expects `openvpn_getaddrinfo()` to return a newly
allocated struct, but getaddrinfo(3) failure leaves `*ai = NULL` as-is.
On OpenBSD, unlike free(3), freegetaddrinfo(3) requires a valid struct,
thus callers must check the argument to avoid NULL-deref or double-free:
```
$ openvpn --server-ipv6 ''
2025-12-06 11:59:18 RESOLVE: Cannot resolve host address: :[AF_INET6] (no address associated with name)
Segmentation fault (core dumped)
```
Guard against empty `ai`, i.e. failure, like similar code already does:
```
$ ./openvpn --server-ipv6 ''
2025-12-06 12:05:11 RESOLVE: Cannot resolve host address: :[AF_INET6] (no address associated with name)
Options error: error parsing --server-ipv6 parameter
Use --help for more information.
```
Spotted through a configuration typo "server-ipv6 fd00:/64" with 2.6.17,
reproduced with and tested against 2.7rc3 on OpenBSD/amd64 7.8-current.
NB: Standards are unclear wrt. freeaddrinfo(3)'s NULL handling;
Linux, FreeBSD and illumos do check it and thus not crash.
Github: fixes OpenVPN/openvpn#930
Change-Id: I99a6604fdfc682f9609bfe7672aa78285084dcb9
Signed-off-by: Klemens Nanni <kn@openbsd.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1418
Message-Id: <20251207210529.9949-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg34870.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 0ff66c056f)
This commit is contained in:
parent
fa20154d58
commit
09c35f8421
1 changed files with 4 additions and 1 deletions
|
|
@ -170,7 +170,10 @@ get_addr_generic(sa_family_t af, unsigned int flags, const char *hostname,
|
|||
*sep = '/';
|
||||
}
|
||||
out:
|
||||
freeaddrinfo(ai);
|
||||
if (ai)
|
||||
{
|
||||
freeaddrinfo(ai);
|
||||
}
|
||||
free(var_host);
|
||||
|
||||
return ret;
|
||||
|
|
|
|||
Loading…
Reference in a new issue