From 09c35f8421028ce8aed4895a526c2f4c4b4be01b Mon Sep 17 00:00:00 2001 From: Klemens Nanni Date: Sun, 7 Dec 2025 22:05:18 +0100 Subject: [PATCH] Prevent crash on invalid server-ipv6 argument `get_addr_generic()` expects `openvpn_getaddrinfo()` to return a newly allocated struct, but getaddrinfo(3) failure leaves `*ai = NULL` as-is. On OpenBSD, unlike free(3), freegetaddrinfo(3) requires a valid struct, thus callers must check the argument to avoid NULL-deref or double-free: ``` $ openvpn --server-ipv6 '' 2025-12-06 11:59:18 RESOLVE: Cannot resolve host address: :[AF_INET6] (no address associated with name) Segmentation fault (core dumped) ``` Guard against empty `ai`, i.e. failure, like similar code already does: ``` $ ./openvpn --server-ipv6 '' 2025-12-06 12:05:11 RESOLVE: Cannot resolve host address: :[AF_INET6] (no address associated with name) Options error: error parsing --server-ipv6 parameter Use --help for more information. ``` Spotted through a configuration typo "server-ipv6 fd00:/64" with 2.6.17, reproduced with and tested against 2.7rc3 on OpenBSD/amd64 7.8-current. NB: Standards are unclear wrt. freeaddrinfo(3)'s NULL handling; Linux, FreeBSD and illumos do check it and thus not crash. Github: fixes OpenVPN/openvpn#930 Change-Id: I99a6604fdfc682f9609bfe7672aa78285084dcb9 Signed-off-by: Klemens Nanni Acked-by: Gert Doering Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1418 Message-Id: <20251207210529.9949-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg34870.html Signed-off-by: Gert Doering (cherry picked from commit 0ff66c056f951dcf01cf6ccb3e9b21948e5ca5ad) --- src/openvpn/socket.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/openvpn/socket.c b/src/openvpn/socket.c index ea06bb18..f0662bef 100644 --- a/src/openvpn/socket.c +++ b/src/openvpn/socket.c @@ -170,7 +170,10 @@ get_addr_generic(sa_family_t af, unsigned int flags, const char *hostname, *sep = '/'; } out: - freeaddrinfo(ai); + if (ai) + { + freeaddrinfo(ai); + } free(var_host); return ret;