From 5def8d935335619b16452b56b332d06f4d621d75 Mon Sep 17 00:00:00 2001 From: Arne Schwabe Date: Tue, 28 Nov 2023 11:43:59 +0100 Subject: [PATCH] Fix check_session_buf_not_used using wrong index The inner loop used i instead of j when iterating through the buffers. Since i is always between 0 and 2 and ks->send_reliable->size is (when it is defined) always 6 (TLS_RELIABLE_N_SEND_BUFFERS) this does not cause an index of out bounds. So while the check was not doing anything really useful with i instead of j, at least it was not crashing or anything similar. Noticed-By: Jon Williams (braindead-bf) on Github issue #449 Change-Id: Ia3d5b4946138df322ebcd9e9e77d04328dacbc5d Signed-off-by: Arne Schwabe Acked-by: Frank Lichtenheld Message-Id: <20231128104359.62967-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27576.html Signed-off-by: Gert Doering (cherry picked from commit 59551b93cdb55397d63b2fe58ad99612821c0faf) --- src/openvpn/ssl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index 18cd21f859f..02e031eadd0 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -3210,7 +3210,7 @@ check_session_buf_not_used(struct buffer *to_link, struct tls_session *session) for (int j = 0; j < ks->send_reliable->size; j++) { - if (ks->send_reliable->array[i].buf.data == dataptr) + if (ks->send_reliable->array[j].buf.data == dataptr) { msg(M_INFO, "Warning buffer of freed TLS session is still in" " use (session->key[%d].send_reliable->array[%d])",