)]}'
{"id":"openvpn~1914","triplet_id":"openvpn~master~I3724236d4acc3d05d786274d6baf34a21c570594","project":"openvpn","branch":"master","attention_set":{},"removed_from_attention_set":{"1000003":{"account":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"last_update":"2026-09-14 06:35:55.000000000","reason":"Change was submitted"},"1000002":{"account":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"last_update":"2026-09-14 06:35:55.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"I3724236d4acc3d05d786274d6baf34a21c570594","subject":"options: fix unsigned underflow when clearing domain_search_list","status":"MERGED","created":"2026-09-13 09:27:30.000000000","updated":"2026-09-14 06:35:55.000000000","submitted":"2026-09-14 06:35:55.000000000","submitter":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"total_comment_count":2,"unresolved_comment_count":2,"has_review_started":true,"submission_id":"1914","meta_rev_id":"5dd6c3e1a30a5c832e0a52c0e4a0f2e760ac55ad","_number":1914,"virtual_id_number":1914,"owner":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"actions":{},"labels":{"Code-Review":{"all":[{"value":0,"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},{"value":0,"_account_id":1000053,"name":"razvanc","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"}],"values":{"-2":"This shall not be submitted","-1":"I would prefer this is not submitted as is"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me, approved"},"description":"","default_value":0}},"removable_reviewers":[{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"}],"reviewers":{"REVIEWER":[{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},{"_account_id":1000053,"name":"razvanc","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"}],"CC":[{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-09-13 09:27:30.000000000","updated_by":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"reviewer":{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"},"state":"CC"},{"updated":"2026-09-13 09:27:30.000000000","updated_by":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"reviewer":{"_account_id":1000003,"name":"plaisthos","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"state":"REVIEWER"},{"updated":"2026-09-13 09:43:36.000000000","updated_by":{"_account_id":1000053,"name":"razvanc","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"reviewer":{"_account_id":1000053,"name":"razvanc","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"state":"CC"},{"updated":"2026-09-13 13:18:11.000000000","updated_by":{"_account_id":1000053,"name":"razvanc","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"reviewer":{"_account_id":1000053,"name":"razvanc","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"state":"REVIEWER"}],"messages":[{"id":"4980eca5f95bbba57de62f8abcfc1bd4be6cc6f8","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-09-13 09:27:30.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"291cb35238cec6ac236bf61163eb4818a7afefe3","author":{"_account_id":1000053,"name":"razvanc","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"date":"2026-09-13 09:43:36.000000000","message":"Patch Set 1:\n\n(2 comments)","accounts_in_message":[],"_revision_number":1},{"id":"a8df8de99851fc26cd691b1d34f52efc931980fd","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-09-13 13:13:18.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"1233550385d405d50ccb55c2b4a48bb7afb60258","author":{"_account_id":1000053,"name":"razvanc","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"date":"2026-09-13 13:18:11.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"5dd6c3e1a30a5c832e0a52c0e4a0f2e760ac55ad","tag":"autogenerated:gerrit:merged","author":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"date":"2026-09-14 06:35:55.000000000","message":"Change has been successfully pushed.","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"aa12dd64b74142bbbff9f37cec05959ba115c06d","revisions":{"7a0342ba24ad6d46a9afd3bb0e128829450cd455":{"kind":"REWORK","_number":1,"created":"2026-09-13 09:27:30.000000000","uploader":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"ref":"refs/changes/14/1914/1","fetch":{"anonymous http":{"url":"http://gerrit.openvpn.net/openvpn","ref":"refs/changes/14/1914/1","commands":{"Branch":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/14/1914/1 \u0026\u0026 git checkout -b change-1914 FETCH_HEAD","Checkout":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/14/1914/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/14/1914/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/14/1914/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull http://gerrit.openvpn.net/openvpn refs/changes/14/1914/1","Reset To":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/14/1914/1 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"af1f73dbe442b42b8a1addc614aa13c3485db266","subject":"socket: factor out UDP socket creation and setup"}],"author":{"name":"Cole Munz","email":"Munzzyy1@proton.me","date":"2026-09-07 19:44:41.000000000","tz":0},"committer":{"name":"Gert Doering","email":"gert@greenie.muc.de","date":"2026-09-13 09:26:59.000000000","tz":120},"subject":"options: fix unsigned underflow when clearing domain_search_list","message":"options: fix unsigned underflow when clearing domain_search_list\n\nremove_option() and update_option() clear the domain search list with\n\n    while (o-\u003edomain_search_list_len-- \u003e 0)\n\ndomain_search_list_len is unsigned, and the post-decrement runs on the\nfinal test too. When the length reaches 0 the condition is false but\nthe decrement has already wrapped it to SIZE_MAX, so the field is left\ncorrupted. The next reset then does\n\n    o-\u003edomain_search_list[SIZE_MAX] \u003d NULL\n\nand walks far out of bounds, writing NULL through each slot. A server\ncan drive this reset path against a client with PUSH_UPDATE, so on\nWindows and Android this is a remotely reachable out-of-bounds write.\n\nTest the length before decrementing, and decrement as part of the\nindex, so it is never taken below 0.\n\nChange-Id: I3724236d4acc3d05d786274d6baf34a21c570594\nSigned-off-by: Cole Munz \u003cMunzzyy1@proton.me\u003e\nGithub: OpenVPN/openvpn-private-issues#178\nCVE: 2026-88964\n"},"branch":"refs/heads/master"},"9115e6dbe9f30a0b4f23da3789328cb193c13150":{"kind":"REWORK","_number":2,"created":"2026-09-13 13:13:18.000000000","uploader":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"ref":"refs/changes/14/1914/2","fetch":{"anonymous http":{"url":"http://gerrit.openvpn.net/openvpn","ref":"refs/changes/14/1914/2","commands":{"Branch":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/14/1914/2 \u0026\u0026 git checkout -b change-1914 FETCH_HEAD","Checkout":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/14/1914/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/14/1914/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/14/1914/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull http://gerrit.openvpn.net/openvpn refs/changes/14/1914/2","Reset To":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/14/1914/2 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"af1f73dbe442b42b8a1addc614aa13c3485db266","subject":"socket: factor out UDP socket creation and setup"}],"author":{"name":"Cole Munz","email":"Munzzyy1@proton.me","date":"2026-09-07 19:44:41.000000000","tz":0},"committer":{"name":"Gert Doering","email":"gert@greenie.muc.de","date":"2026-09-13 13:11:36.000000000","tz":120},"subject":"options: fix unsigned underflow when clearing domain_search_list","message":"options: fix unsigned underflow when clearing domain_search_list\n\nremove_option() and update_option() clear the domain search list with\n\n    while (o-\u003edomain_search_list_len-- \u003e 0)\n\ndomain_search_list_len is unsigned, and the post-decrement runs on the\nfinal test too. When the length reaches 0 the condition is false but\nthe decrement has already wrapped it to UINT_MAX, so the field is left\ncorrupted. The next reset then does\n\n    o-\u003edomain_search_list[UINT_MAX] \u003d NULL\n\nand walks far out of bounds, writing NULL through each slot. A server\ncan drive this reset path against a client with PUSH_UPDATE, so on\nWindows and Android this is a remotely reachable out-of-bounds write.\n\nv2:\n  Change to the semantics used for all the other lists there - set\n  length to 0 and clear the list with CLEAR().\n\nChange-Id: I3724236d4acc3d05d786274d6baf34a21c570594\nSigned-off-by: Cole Munz \u003cMunzzyy1@proton.me\u003e\nGithub: OpenVPN/openvpn-private-issues#178\nCVE: 2026-88964\n"},"branch":"refs/heads/master"},"aa12dd64b74142bbbff9f37cec05959ba115c06d":{"kind":"TRIVIAL_REBASE_WITH_MESSAGE_UPDATE","_number":3,"created":"2026-09-14 06:35:55.000000000","uploader":{"_account_id":1000002,"name":"cron2","display_name":"Gert Doering","email":"gert@greenie.muc.de","username":"cron2"},"ref":"refs/changes/14/1914/3","fetch":{"anonymous http":{"url":"http://gerrit.openvpn.net/openvpn","ref":"refs/changes/14/1914/3","commands":{"Branch":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/14/1914/3 \u0026\u0026 git checkout -b change-1914 FETCH_HEAD","Checkout":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/14/1914/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/14/1914/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/14/1914/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull http://gerrit.openvpn.net/openvpn refs/changes/14/1914/3","Reset To":"git fetch http://gerrit.openvpn.net/openvpn refs/changes/14/1914/3 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"a57e39923d55987336f544ce0c1b3b42c35f0ec0","subject":"Remove various useless assignments"}],"author":{"name":"Cole Munz","email":"Munzzyy1@proton.me","date":"2026-09-13 13:23:17.000000000","tz":120},"committer":{"name":"Gert Doering","email":"gert@greenie.muc.de","date":"2026-09-14 06:31:20.000000000","tz":120},"subject":"options: fix unsigned underflow when clearing domain_search_list","message":"options: fix unsigned underflow when clearing domain_search_list\n\nremove_option() and update_option() clear the domain search list with\n\n    while (o-\u003edomain_search_list_len-- \u003e 0)\n\ndomain_search_list_len is unsigned, and the post-decrement runs on the\nfinal test too. When the length reaches 0 the condition is false but\nthe decrement has already wrapped it to UINT_MAX, so the field is left\ncorrupted. The next reset then does\n\n    o-\u003edomain_search_list[UINT_MAX] \u003d NULL\n\nand walks far out of bounds, writing NULL through each slot. A server\ncan drive this reset path against a client with PUSH_UPDATE, so on\nWindows and Android this is a remotely reachable out-of-bounds write.\n\nv2:\n  Change to the semantics used for all the other lists there - set\n  length to 0 and clear the list with CLEAR().\n\nChange-Id: I3724236d4acc3d05d786274d6baf34a21c570594\nSigned-off-by: Cole Munz \u003cMunzzyy1@proton.me\u003e\nAcked-by: Razvan Cojocaru \u003crazvanc@mailbox.org\u003e\nGerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1914\nGithub: OpenVPN/openvpn-private-issues#178\nCVE: 2026-88964\nMessage-Id: \u003c20260913132322.2283-1-gert@greenie.muc.de\u003e\nURL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg39157.html\nSigned-off-by: Gert Doering \u003cgert@greenie.muc.de\u003e\n"},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[]}