[PR #73] fix: bound device-level netlink attributes #74

New issue

Open

opened 2026-10-13 21:03:02 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 21:03:02 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/amnezia-vpn/amneziawg-tools/pull/73
Author: @HeisLuka
Created: 9/14/2026
Status: 🔄 Open

Base: master ← Head: fix/device-netlink-buffer-overflow

📝 Commits (1)

3360475 fix: bound device netlink attributes

📊 Changes

1 file changed (+55 additions, -33 deletions)

View changed files

📝 src/ipc-linux.h (+55 -33)

📄 Description

Summary

bounds-check the large device-level I1–I5 attributes against SOCKET_BUFFER_SIZE
bounds-check the device attributes that follow them, so a nearly-full message cannot overflow on a later fixed-size attribute
use a checked WGDEVICE_A_PEERS nest start; if the device block fits but leaves no room for peers, send the device attributes first and continue peers in a fresh message
return EMSGSIZE before sending when the device-level attribute block itself cannot fit

This removes the write-side heap overflow described in #69 without changing the existing peer-splitting behavior.

The read-side dump hang/leak discussed in the issue comments is separate and is not addressed here.

Fixes #69

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/amnezia-vpn/amneziawg-tools/pull/73 **Author:** [@HeisLuka](https://github.com/HeisLuka) **Created:** 9/14/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `fix/device-netlink-buffer-overflow` --- ### 📝 Commits (1) - [`3360475`](https://github.com/amnezia-vpn/amneziawg-tools/commit/336047532130ad5cfea1ed96c30b1edbb2cc2b64) fix: bound device netlink attributes ### 📊 Changes **1 file changed** (+55 additions, -33 deletions) <details> <summary>View changed files</summary> 📝 `src/ipc-linux.h` (+55 -33) </details> ### 📄 Description ## Summary - bounds-check the large device-level `I1`–`I5` attributes against `SOCKET_BUFFER_SIZE` - bounds-check the device attributes that follow them, so a nearly-full message cannot overflow on a later fixed-size attribute - use a checked `WGDEVICE_A_PEERS` nest start; if the device block fits but leaves no room for peers, send the device attributes first and continue peers in a fresh message - return `EMSGSIZE` before sending when the device-level attribute block itself cannot fit This removes the write-side heap overflow described in #69 without changing the existing peer-splitting behavior. The read-side dump hang/leak discussed in the issue comments is separate and is not addressed here. Fixes #69 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-13 21:03:02 +00:00

bsakaguchi referenced this issue

2026-10-13 21:03:02 +00:00

[PR #74] fix: omit empty AWG 3.x ranges from showconf #75