)]}'
{"id":"openvpn~1905","triplet_id":"openvpn~release%2F2.6~I6a886a1cac2d4725859dab2325cd362312ddc659","project":"openvpn","branch":"release/2.6","full_branch":"refs/heads/release/2.6","attention_set":{},"removed_from_attention_set":{"1000030":{"account":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"last_update":"2026-09-09 08:40:54.000000000","reason":"\u003cGERRIT_ACCOUNT_1000030\u003e replied on the change","reason_account":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"}},"1000053":{"account":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"last_update":"2026-09-09 08:41:10.000000000","reason":"Change was abandoned"},"1000003":{"account":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"last_update":"2026-09-09 08:41:10.000000000","reason":"Change was abandoned"},"1000002":{"account":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"last_update":"2026-09-09 08:41:10.000000000","reason":"Change was abandoned"}},"hashtags":[],"change_id":"I6a886a1cac2d4725859dab2325cd362312ddc659","subject":"dhcp: Fix off-by-one in write_dhcp_search_str() temp buffer guard","status":"ABANDONED","created":"2026-09-08 16:32:30.000000000","updated":"2026-09-09 08:41:10.000000000","total_comment_count":2,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"c161d075085dae093aa0c50a0803e1b55853ebb8","_number":1905,"virtual_id_number":1905,"owner":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"actions":{},"labels":{"Code-Review":{"disliked":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"all":[{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},{"value":-1,"date":"2026-09-08 16:45:22.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"}],"values":{"-2":"This shall not be submitted","-1":"I would prefer this is not submitted as is"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me, approved"},"description":"","value":-1,"default_value":0}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"}],"CC":[{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-09-08 16:32:30.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"state":"REVIEWER"},{"updated":"2026-09-08 16:32:30.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"state":"REVIEWER"},{"updated":"2026-09-08 16:32:31.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"},"state":"CC"},{"updated":"2026-09-08 16:32:31.000000000","updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"real_updated_by":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"reviewer":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"state":"REVIEWER"}],"messages":[{"id":"95935d121aaafd9e0b55c4c53826f2fc1fdd75d8","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"date":"2026-09-08 16:32:30.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"ab28355696e398536519f1ccf04336c40325de97","author":{"_account_id":1000002,"name":"Gert Doering","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-09-08 16:45:22.000000000","message":"Patch Set 1: Code-Review-1\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"082104359286b81f545fc7788a61c17c1d63c1be","author":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"date":"2026-09-09 08:40:54.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"c161d075085dae093aa0c50a0803e1b55853ebb8","tag":"autogenerated:gerrit:abandon","author":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"date":"2026-09-09 08:41:10.000000000","message":"Abandoned\n\nAlready backported","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"83a0276cbe830f8e28fe239cef35a83bb75d1001","revisions":{"83a0276cbe830f8e28fe239cef35a83bb75d1001":{"kind":"REWORK","_number":1,"created":"2026-09-08 16:32:30.000000000","uploader":{"_account_id":1000030,"name":"Max Fillinger","email":"max@max-fillinger.net","username":"MaxF"},"ref":"refs/changes/05/1905/1","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/05/1905/1","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/05/1905/1 \u0026\u0026 git checkout -b change-1905 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/05/1905/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/05/1905/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/05/1905/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/05/1905/1","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/05/1905/1 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"7dae631514b331485505470bbb8bcc67fb881d8f","subject":"Move check_session_buf_not_used method into the method that free the buffer"}],"author":{"name":"Nexory","email":"St4yl3r30@hotmail.de","date":"2026-08-31 08:34:40.000000000","tz":120},"committer":{"name":"Max Fillinger","email":"maximilian.fillinger@sentyron.com","date":"2026-09-08 14:29:22.000000000","tz":120},"subject":"dhcp: Fix off-by-one in write_dhcp_search_str() temp buffer guard","message":"dhcp: Fix off-by-one in write_dhcp_search_str() temp buffer guard\n\nEach search list entry consumes strlen(ptr) + 2 bytes of tmp_buf: one\nleading label length byte, the domain characters, and one trailing NUL.\nThe guard only accounted for strlen(ptr) + 1, so a sequence of entries\nwhose accumulated length lands exactly on the boundary passed the check\nand then wrote tmp_buf[256], one byte past the 256 byte array.\n\nThe existing \"len \u003e 255\" check enforces the correct upper bound, but it\nruns after that write has already happened.\n\nThe entries can be pushed by the server: --dhcp-option falls under\nOPT_P_DHCPDNS, which pull_permission_mask() includes, and\nvalidate_domain() imposes no length limit.\n\nReproduced under AddressSanitizer, which reports a one byte\nstack-buffer-overflow at dhcp.c:308. The added unit test covers the\nboundary; it fails before this change and passes after it. The two\nexisting cases marked \"maximum length\" are unaffected, since a 253\ncharacter domain still satisfies 253 + 0 + 2 \u003c\u003d 256.\n\n(Note: The unit tests have not been included in the cherry-pick to 2.6\nbecause test_dhcp.c did not exist in this version.)\n\nThis was reported independently by Andre Kropp and Chính Nguyễn Văn.\nPatch author is Andre Kropp, recording both reports in the Reported-By:\n\nCVE: 2026-81738\nChange-Id: I6a886a1cac2d4725859dab2325cd362312ddc659\nSigned-off-by: Nexory \u003cSt4yl3r30@hotmail.de\u003e\nAcked-by: Gert Doering \u003cgert@greenie.muc.de\u003e\nAcked-by: Razvan Cojocaru \u003crazvanc@mailbox.org\u003e\nGerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1884\nReported-By: Andre Kropp (Nexory)\nReported-By: ChinhNguyen\nMessage-Id: \u003c20260831083449.12484-1-gert@greenie.muc.de\u003e\nSigned-off-by: Gert Doering \u003cgert@greenie.muc.de\u003e\n(cherry picked from commit 1ece6fe6fd586501b486aac6932d424c167a3adb)\n"},"branch":"refs/heads/release/2.6"}},"requirements":[],"submit_records":[]}