Tags: OpenVPN/tap-windows6
Tags
Fix potential integer overflow in TapSharedSendPacket Following code: unsigned int fullLength; <..> fullLength = PacketLength + PrefixLength; could cause integer overflow, which will result in allocation of smaller size of memory, which later causes buffer overflow and a bug check. Fix by checking overflow condition and fail the IRP in case of overflow. CVE: 2024-1305 Reported-by: Vladimir Tokarev <vtokarev@microsoft.com> Signed-off-by: Lev Stipakov <lev@openvpn.net>