sstp-client: unavoidable overflow of a fixed-size buffer for pppd args

Package Name

sstp-client

Maintainer

@fededim

OpenWrt Version

24.10.2

OpenWrt Target/Subtarget

ath79/generic

Steps to Reproduce

In the source of sstp-client (link), there is a fixed-size buffer for PPPD arguments:

const char *args[20];

Now consider this perfectly valid config:

config interface 'mysstp'
	option proto 'sstp'
	option server 'sstp.vpn.net'
	option username 'USER'
	option password 'PASSWORD'
	option ipv6 '1'
	option log_level '0'
	option peerdns '0'
	list dns '8.8.8.8'
	list dns '8.8.4.4'
	option metric '91'
	option pppd_options 'defaultroute-metric 91'
	option dns_metric '70'

(The duplication of the metric is due to https://github.com/openwrt/packages/issues/25213)

Actual Behaviour

See in the strace log (strace -f -e execve -p $(pidof netifd)) how sstpc and pppd get invoked:

[pid  5641] execve("/usr/bin/sstpc", ["sstpc", "--cert-warn", "--password", "PASSWORD", "--user", "USER", "--log-level", "0", "--save-server-route", "--ipparam", "mysstp", "sstp.vpn.net", "ifname", "sstp-mysstp", "require-mschap-v2", "+ipv6", "refuse-pap", "noauth", "replacedefaultroute", "defaultroute", "ip-up-script", "/lib/netifd/ppp-up", "ipv6-up-script", "/lib/netifd/ppp-up", "ip-down-script", "/lib/netifd/ppp-down", "ipv6-down-script", "/lib/netifd/ppp-down", "defaultroute-metric", "91"], 0x7f70190c /* 3 vars */ <unfinished ...>
[pid  5706] execve("/usr/sbin/pppd", ["/dev/pts/2", "<binary garbage but there should be fake port speed like 115200 here>", "user", "USER", "file", "/tmp//sstp-pppd.pcpphl", "ifname", "sstp-mysstp", "require-mschap-v2", "+ipv6", "refuse-pap", "noauth", "replacedefaultroute", "defaultroute", "ip-up-script", "/lib/netifd/ppp-up", "ipv6-up-script", "/lib/netifd/ppp-up", "ip-down-script", "/lib/netifd/ppp-down", "ipv6-down-script", "/lib/netifd/ppp-down", "defaultroute-metric", "91"], 0x7fb77780 /* 3 vars */) = 0

Look: the second pppd argument is some binary garbage that causes pppd to quit immediately - i.e., nothing works. It worked in 23.05.5 (by pure chance).

Let's also count arguments, including /usr/sbin/pppd: there are 25 of them! It's clearly a buffer overflow. I don't fully understand how it caused one of them to be overwritten by binary garbage, but it did.

Recompiling sstp-client with the increased array size and installing libopenssl-legacy resulted in a successful connection.

Confirmation Checklist

• The package is maintained in this repository.
• I understand that issues related to the base OpenWrt repository or LuCI repository will be closed.
• I am reporting an issue for OpenWrt, not an unsupported fork.

Start with sstp-client's src/sstp-pppd.c around line 512 and reproduce the reported configuration while tracing sstpc and pppd with strace. Verify how the pppd argument list is assembled and confirm done when the valid configuration no longer corrupts an argument and establishes a successful connection.