File openvpn-2.3.x-fixed-multiple-low-severity-issue... of Package openvpn

Overview Repositories Revisions Requests Users Attributes Meta

File openvpn-2.3.x-fixed-multiple-low-severity-issues.patch of Package openvpn (Revision 4fae53ffd4fcb437379d3970763535fa)

Currently displaying revision 4fae53ffd4fcb437379d3970763535fa , Show latest

diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index 09659aa..b35d884 100644
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -119,7 +119,7 @@ openvpn_encrypt_aead(struct buffer *buf, struct buffer work,
     dmsg(D_PACKET_CONTENT, "ENCRYPT FROM: %s", format_hex(BPTR(buf), BLEN(buf), 80, &gc));
 
     /* Buffer overflow check */
-    if (!buf_safe(&work, buf->len + cipher_ctx_block_size(ctx->cipher)))
+    if (!buf_safe(&work, buf->len + OPENVPN_MAX_BLOCK_LENGTH))
     {
         msg(D_CRYPT_ERRORS,
             "ENCRYPT: buffer size error, bc=%d bo=%d bl=%d wc=%d wo=%d wl=%d",
@@ -238,7 +238,7 @@ openvpn_encrypt_v1(struct buffer *buf, struct buffer work,
             ASSERT(cipher_ctx_reset(ctx->cipher, iv_buf));
 
             /* Buffer overflow check */
-            if (!buf_safe(&work, buf->len + cipher_ctx_block_size(ctx->cipher)))
+            if (!buf_safe(&work, buf->len + OPENVPN_MAX_BLOCK_LENGTH))
             {
                 msg(D_CRYPT_ERRORS, "ENCRYPT: buffer size error, bc=%d bo=%d bl=%d wc=%d wo=%d wl=%d cbs=%d",
                     buf->capacity,
@@ -379,7 +379,7 @@ openvpn_decrypt_aead(struct buffer *buf, struct buffer work,
     const cipher_kt_t *cipher_kt = cipher_ctx_get_cipher_kt(ctx->cipher);
     uint8_t *tag_ptr = NULL;
     int tag_size = 0;
-    int outlen;
+    int outlen = 0;
     struct gc_arena gc;
 
     gc_init(&gc);
@@ -456,7 +456,7 @@ openvpn_decrypt_aead(struct buffer *buf, struct buffer work,
     dmsg(D_PACKET_CONTENT, "DECRYPT FROM: %s", format_hex(BPTR(buf), BLEN(buf), 0, &gc));
 
     /* Buffer overflow check (should never fail) */
-    if (!buf_safe(&work, buf->len + cipher_ctx_block_size(ctx->cipher)))
+    if (!buf_safe(&work, buf->len + OPENVPN_MAX_BLOCK_LENGTH))
     {
         CRYPT_ERROR("potential buffer overflow");
     }
@@ -602,7 +602,7 @@ openvpn_decrypt_v1(struct buffer *buf, struct buffer work,
             }
 
             /* Buffer overflow check (should never happen) */
-            if (!buf_safe(&work, buf->len + cipher_ctx_block_size(ctx->cipher)))
+            if (!buf_safe(&work, buf->len + OPENVPN_MAX_BLOCK_LENGTH))
             {
                 CRYPT_ERROR("potential buffer overflow");
             }
diff --git a/src/openvpn/crypto_openssl.h b/src/openvpn/crypto_openssl.h
index f8ddbc8..7706b02 100644
--- a/src/openvpn/crypto_openssl.h
+++ b/src/openvpn/crypto_openssl.h
@@ -53,6 +53,9 @@ typedef HMAC_CTX hmac_ctx_t;
 /** Maximum length of an IV */
 #define OPENVPN_MAX_IV_LENGTH   EVP_MAX_IV_LENGTH
 
+/** Maximum length of a cipher block */
+#define OPENVPN_MAX_BLOCK_LENGTH   EVP_MAX_BLOCK_LENGTH
+
 /** Cipher is in CBC mode */
 #define OPENVPN_MODE_CBC        EVP_CIPH_CBC_MODE
 
diff --git a/src/openvpn/init.c b/src/openvpn/init.c
index 66126ef..b8d4a8c 100644
--- a/src/openvpn/init.c
+++ b/src/openvpn/init.c
@@ -3052,8 +3052,8 @@ init_context_buffers(const struct frame *frame)
     b->aux_buf = alloc_buf(BUF_SIZE(frame));
 
 #ifdef ENABLE_CRYPTO
-    b->encrypt_buf = alloc_buf(BUF_SIZE(frame));
-    b->decrypt_buf = alloc_buf(BUF_SIZE(frame));
+    b->encrypt_buf = alloc_buf(BUF_SIZE(frame) + OPENVPN_MAX_BLOCK_LENGTH);
+    b->decrypt_buf = alloc_buf(BUF_SIZE(frame) + OPENVPN_MAX_BLOCK_LENGTH);
 #endif
 
 #ifdef USE_COMP
diff --git a/src/openvpn/proxy.c b/src/openvpn/proxy.c
index b0ed327..0ad0385 100644
--- a/src/openvpn/proxy.c
+++ b/src/openvpn/proxy.c
@@ -74,6 +74,9 @@ recv_line(socket_descriptor_t sd,
     struct buffer la;
     int lastc = 0;
 
+	if (sd >= FD_SETSIZE)
+		return false;
+
     CLEAR(la);
     if (lookahead)
     {
@@ -312,11 +315,11 @@ get_proxy_authenticate(socket_descriptor_t sd,
                        struct gc_arena *gc,
                        volatile int *signal_received)
 {
-    char buf[256];
+    char buf[256] = {0};
     int ret = HTTP_AUTH_NONE;
     while (true)
     {
-        if (!recv_line(sd, buf, sizeof(buf), timeout, true, NULL, signal_received))
+        if (!recv_line(sd, buf, sizeof(buf) - 1, timeout, true, NULL, signal_received))
         {
             *data = NULL;
             return HTTP_AUTH_NONE;
@@ -631,9 +634,9 @@ establish_http_proxy_passthru(struct http_proxy_info *p,
                               volatile int *signal_received)
 {
     struct gc_arena gc = gc_new();
-    char buf[512];
-    char buf2[129];
-    char get[80];
+    char buf[512]  = {0};
+    char buf2[129] = {0};
+    char get[80]   = {0};
     int status;
     int nparms;
     bool ret = false;
@@ -723,7 +726,8 @@ establish_http_proxy_passthru(struct http_proxy_info *p,
         }
 
         /* receive reply from proxy */
-        if (!recv_line(sd, buf, sizeof(buf), get_server_poll_remaining_time(server_poll_timeout), true, NULL, signal_received))
+		memset(buf, 0, sizeof(buf));
+        if (!recv_line(sd, buf, sizeof(buf) - 1, get_server_poll_remaining_time(server_poll_timeout), true, NULL, signal_received))
         {
             goto error;
         }
@@ -754,7 +758,8 @@ establish_http_proxy_passthru(struct http_proxy_info *p,
 
             while (true)
             {
-                if (!recv_line(sd, buf, sizeof(buf), get_server_poll_remaining_time(server_poll_timeout), true, NULL, signal_received))
+				memset(buf, 0, sizeof(buf));
+                if (!recv_line(sd, buf, sizeof(buf) - 1, get_server_poll_remaining_time(server_poll_timeout), true, NULL, signal_received))
                 {
                     goto error;
                 }
@@ -834,7 +839,8 @@ establish_http_proxy_passthru(struct http_proxy_info *p,
             }
 
             /* receive reply from proxy */
-            if (!recv_line(sd, buf, sizeof(buf), get_server_poll_remaining_time(server_poll_timeout), true, NULL, signal_received))
+			memset(buf, 0, sizeof(buf));
+            if (!recv_line(sd, buf, sizeof(buf) - 1, get_server_poll_remaining_time(server_poll_timeout), true, NULL, signal_received))
             {
                 goto error;
             }
@@ -952,7 +958,8 @@ establish_http_proxy_passthru(struct http_proxy_info *p,
                 }
 
                 /* receive reply from proxy */
-                if (!recv_line(sd, buf, sizeof(buf), get_server_poll_remaining_time(server_poll_timeout), true, NULL, signal_received))
+				memset(buf, 0, sizeof(buf));
+                if (!recv_line(sd, buf, sizeof(buf) - 1, get_server_poll_remaining_time(server_poll_timeout), true, NULL, signal_received))
                 {
                     goto error;
                 }
diff --git a/src/openvpn/socket.c b/src/openvpn/socket.c
index 7d3dd60..334c47e 100644
--- a/src/openvpn/socket.c
+++ b/src/openvpn/socket.c
@@ -1163,6 +1163,9 @@ socket_listen_accept(socket_descriptor_t sd,
     /* struct openvpn_sockaddr *remote = &act->dest; */
     struct openvpn_sockaddr remote_verify = act->dest;
     socket_descriptor_t new_sd = SOCKET_UNDEFINED;
+	
+	if (sd >= FD_SETSIZE)
+		return -1;
 
     CLEAR(*act);
     socket_do_listen(sd, local, do_listen, true);
@@ -1315,6 +1318,9 @@ openvpn_connect(socket_descriptor_t sd,
 {
     int status = 0;
 
+	if (sd >= FD_SETSIZE)
+		return -1;
+
 #ifdef TARGET_ANDROID
     protect_fd_nonlocal(sd, remote);
 #endif
diff --git a/src/openvpn/socks.c b/src/openvpn/socks.c
index b50cac3..79632a8 100644
--- a/src/openvpn/socks.c
+++ b/src/openvpn/socks.c
@@ -99,13 +99,16 @@ socks_username_password_auth(struct socks_proxy_info *p,
                              socket_descriptor_t sd,
                              volatile int *signal_received)
 {
-    char to_send[516];
-    char buf[2];
+    char to_send[516] = {0};
+    char buf[2] = {0};
     int len = 0;
     const int timeout_sec = 5;
     struct user_pass creds;
     ssize_t size;
 
+	if (sd >= FD_SETSIZE)
+		return false;
+
     creds.defined = 0;
     if (!get_user_pass(&creds, p->authfile, UP_TYPE_SOCKS, GET_USER_PASS_MANAGEMENT))
     {
@@ -194,7 +197,7 @@ socks_handshake(struct socks_proxy_info *p,
                 socket_descriptor_t sd,
                 volatile int *signal_received)
 {
-    char buf[2];
+    char buf[2] = {0};
     int len = 0;
     const int timeout_sec = 5;
     ssize_t size;
@@ -206,6 +209,9 @@ socks_handshake(struct socks_proxy_info *p,
         method_sel[2] = 0x02; /* METHODS = [2 (plain login)] */
 
     }
+	if  (sd >= FD_SETSIZE)
+		return false;
+
     size = send(sd, method_sel, sizeof(method_sel), MSG_NOSIGNAL);
     if (size != sizeof(method_sel))
     {
@@ -313,9 +319,12 @@ recv_socks_reply(socket_descriptor_t sd,
     char atyp = '\0';
     int alen = 0;
     int len = 0;
-    char buf[22];
+    char buf[22] = {0};
     const int timeout_sec = 5;
 
+	if (sd >= FD_SETSIZE)
+		return false;
+
     if (addr != NULL)
     {
         addr->addr.in4.sin_family = AF_INET;
@@ -396,7 +405,7 @@ recv_socks_reply(socket_descriptor_t sd,
         }
 
         /* store char in buffer */
-        if (len < (int)sizeof(buf))
+        if (len < (int)sizeof(buf) && len >= 0)
         {
             buf[len] = c;
         }
@@ -448,7 +457,7 @@ establish_socks_proxy_passthru(struct socks_proxy_info *p,
                                const char *servname,    /* openvpn server port */
                                volatile int *signal_received)
 {
-    char buf[128];
+    char buf[128] = {0};
     size_t len;
 
     if (!socks_handshake(p, sd, signal_received))

Places

File openvpn-2.3.x-fixed-multiple-low-severity-issues.patch of Package openvpn (Revision 4fae53ffd4fcb437379d3970763535fa)

Places