From 77097440ebe29f6bcc47b7511ebbda275d9a9eb0 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Sat, 16 May 2026 12:05:03 +0200 Subject: [PATCH] worker: fix heap buffer overflow in webvpncontext= cookie decoding An unauthenticated client could send a Cookie header with a webvpncontext= value long enough that its base64-decoded length far exceeded SID_SIZE (32 bytes). The decoder wrote directly into ws->sid without a prior length check, overwriting adjacent fields in worker_st and crashing the worker. The webvpn= cookie already had the correct pattern: check decoded length bounds before decoding, decode into the ws->buffer scratch area, then memcpy into the target only on an exact-size match. Apply the same pattern to webvpncontext=. Resolves: #719 Signed-off-by: Nikos Mavrogiannopoulos --- NEWS | 2 ++ src/worker-http.c | 11 ++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/NEWS b/NEWS index 12d75a1a..2d859dcb 100644 --- a/NEWS +++ b/NEWS @@ -1,4 +1,6 @@ * Version 1.5.0 (unreleased) +- [SECURITY] Fixed unauthenticated heap buffer overflow in the unprivileged + worker process via an oversized webvpncontext= cookie value (#719) - Added `syslog-facility` option to log to specified syslog facility (#691) - Fixed worker hang when a client disappears silently (#638) - Removed the 'cgroup' configuration option (used for cgroups v1). diff --git a/src/worker-http.c b/src/worker-http.c index e8c9280d..063f3820 100644 --- a/src/worker-http.c +++ b/src/worker-http.c @@ -719,14 +719,23 @@ ciphersuite12_finish: } nlen = BASE64_DECODE_LENGTH(tmplen); + if (nlen < sizeof(ws->sid) || + nlen > sizeof(ws->sid) + 8) + return; + + if (sizeof(ws->buffer) < sizeof(ws->sid) + 8) + abort(); + ret = oc_base64_decode((uint8_t *)p, tmplen, - ws->sid, &nlen); + ws->buffer, &nlen); if (ret == 0 || nlen != sizeof(ws->sid)) { oclog(ws, LOG_SENSITIVE, "could not decode sid: %.*s", tmplen, p); ws->sid_set = 0; } else { + memcpy(ws->sid, ws->buffer, + sizeof(ws->sid)); ws->sid_set = 1; oclog(ws, LOG_SENSITIVE, "received sid: %.*s", tmplen, p);