search

OpenVPN / tap-windows6

Windows TAP driver (NDIS 6)
Other
765 stars 238 forks source link

Fix potential integer overflow in TapSharedSendPacket #167

Closed lstipakov closed 4 months ago

lstipakov commented 4 months ago

Following code:

unsigned int fullLength; <..> fullLength = PacketLength + PrefixLength;

could cause integer overflow, which will result in allocation of smaller size of memory, which later causes buffer overflow and a bug check.

Fix by checking overflow condition and fail the IRP in case of overflow.

CVE: 2024-1305

Reported-by: Vladimir Tokarev vtokarev@microsoft.com

cron2 commented 4 months ago

Looks good to me. ACK.