)]}'
{"id":"openvpn~2002","triplet_id":"openvpn~master~I379c36e1557178d22d3ee27cd6ed51b5c3a2e793","project":"openvpn","branch":"master","full_branch":"refs/heads/master","attention_set":{"1000003":{"account":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"last_update":"2026-10-17 16:21:10.000000000","reason":"Reviewer was added"}},"removed_from_attention_set":{},"hashtags":[],"change_id":"I379c36e1557178d22d3ee27cd6ed51b5c3a2e793","subject":"Keep the outgoing control packet in a buffer owned by tls_multi","status":"NEW","created":"2026-10-17 16:21:08.000000000","updated":"2026-10-17 16:21:10.000000000","submit_type":"CHERRY_PICK","total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"6ac8981be842e75964d2c167ceb0058cb04afbfc","_number":2002,"virtual_id_number":2002,"owner":{"_account_id":1000059,"name":"Alejandro","email":"alepacheco99@gmail.com","username":"alepacheco"},"actions":{},"labels":{"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"}],"values":{"-2":"This shall not be submitted","-1":"I would prefer this is not submitted as is"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me, approved"},"description":"","default_value":0}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"}],"CC":[{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-10-17 16:21:10.000000000","updated_by":{"_account_id":1000059,"name":"Alejandro","email":"alepacheco99@gmail.com","username":"alepacheco"},"real_updated_by":{"_account_id":1000059,"name":"Alejandro","email":"alepacheco99@gmail.com","username":"alepacheco"},"reviewer":{"_account_id":1000026,"name":"openvpn-devel","email":"openvpn-devel@lists.sourceforge.net","username":"openvpn-devel"},"state":"CC"},{"updated":"2026-10-17 16:21:10.000000000","updated_by":{"_account_id":1000059,"name":"Alejandro","email":"alepacheco99@gmail.com","username":"alepacheco"},"real_updated_by":{"_account_id":1000059,"name":"Alejandro","email":"alepacheco99@gmail.com","username":"alepacheco"},"reviewer":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"state":"REVIEWER"}],"messages":[{"id":"a552014def1e7d2b507fe279cbc84b8374a3e525","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1000059,"name":"Alejandro","email":"alepacheco99@gmail.com","username":"alepacheco"},"date":"2026-10-17 16:21:08.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"0ee0687f4274f1408174f4c8bf605b4175fcc448","revisions":{"0ee0687f4274f1408174f4c8bf605b4175fcc448":{"kind":"REWORK","_number":1,"created":"2026-10-17 16:21:08.000000000","uploader":{"_account_id":1000059,"name":"Alejandro","email":"alepacheco99@gmail.com","username":"alepacheco"},"ref":"refs/changes/02/2002/1","fetch":{"anonymous http":{"url":"https://gerrit.openvpn.net/openvpn","ref":"refs/changes/02/2002/1","commands":{"Branch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/02/2002/1 \u0026\u0026 git checkout -b change-2002 FETCH_HEAD","Checkout":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/02/2002/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/02/2002/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/02/2002/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://gerrit.openvpn.net/openvpn refs/changes/02/2002/1","Reset To":"git fetch https://gerrit.openvpn.net/openvpn refs/changes/02/2002/1 \u0026\u0026 git reset --hard FETCH_HEAD"}}},"commit":{"parents":[{"commit":"dda75df387f83ae10741d74a516495466ca78964","subject":"configure: Add --enable-code-coverage"}],"author":{"name":"Alejandro Pacheco","email":"alepacheco99@gmail.com","date":"2026-10-17 04:04:13.000000000","tz":120},"committer":{"name":"Alejandro Pacheco","email":"alepacheco99@gmail.com","date":"2026-10-17 16:09:52.000000000","tz":120},"subject":"Keep the outgoing control packet in a buffer owned by tls_multi","message":"Keep the outgoing control packet in a buffer owned by tls_multi\n\ntls_multi_process() returns the outgoing control packet in to_link.\nUntil now to_link pointed into memory owned by a session or key state:\nthe reliable send buffer, ks-\u003eack_write_buf, or the tls_wrap or\ntls_wrap_reneg work buffer.  When that session or key state was freed\nor reset before the packet was written to the link, to_link was left\npointing to freed memory.  This caused CVE-2023-46850, CVE-2026-40215,\nCVE-2026-12996, CVE-2026-13117 and CVE-2026-84471.\n\nThe fixes so far added check_session_buf_not_used() and\ncheck_keystate_buf_not_used(), which compare to_link against a list of\nthe buffers of a session or key state before it is freed and drop the\npacket on a match.  This only works as long as the list names every\nbuffer a packet can end up in and every caller that frees a session or\nkey state passes to_link down: key_state_soft_reset() is called without\nit from tls_pre_decrypt() and tls_session_soft_reset().\n\nFix the ownership instead.  write_control_auth() now copies the\nfinished packet into a buffer the caller owns, and tls_multi_process()\nreturns it in multi-\u003eto_link_buf, which lives as long as the tls_multi,\nlike multi-\u003eto_link_addr already does for the address.  Freeing or\nmoving sessions and key states no longer affects a pending packet, so\nthe checks and the to_link parameters of key_state_free(),\ntls_session_free(), move_session(), reset_session() and\nkey_state_soft_reset() are removed.  A packet that is pending when its\nsession is freed is now sent instead of dropped; the peer handles it\nlike any late packet of that session.\n\nThe copy costs one memcpy of a control channel packet.  The new unit\ntest checks that the packet written by write_control_auth() stays\nintact and valid after the buffers it was built from are overwritten,\nwith no wrapping, tls-auth and tls-crypt.\n\nChange-Id: I379c36e1557178d22d3ee27cd6ed51b5c3a2e793\nSigned-off-by: Alejandro Pacheco \u003calepacheco99@gmail.com\u003e\n"},"branch":"refs/heads/master"}},"requirements":[{"status":"NOT_READY","fallback_text":"All required checks must pass","type":"checks_pass"}],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"NOT_READY","labels":[{"label":"Code-Review","status":"NEED"}]},{"rule_name":"checks~ChecksSubmitRule","status":"NOT_READY","requirements":[{"status":"NOT_READY","fallback_text":"All required checks must pass","type":"checks_pass"}]}]}