From 1fe813f05ed12530be62d41788c44541df367d01 Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Fri, 12 Jun 2026 16:43:05 +0200
Subject: [PATCH] wolfssl: Fix memory leak on failed ICV verification if not
 using in-place decryption

Fixes: c92eade82c81 ("wolfssl: Add wolfSSL plugin for cryptographic implementations")
---
 src/libstrongswan/plugins/wolfssl/wolfssl_aead.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/libstrongswan/plugins/wolfssl/wolfssl_aead.c b/src/libstrongswan/plugins/wolfssl/wolfssl_aead.c
index 44f054916..4c9e8d74d 100644
--- a/src/libstrongswan/plugins/wolfssl/wolfssl_aead.c
+++ b/src/libstrongswan/plugins/wolfssl/wolfssl_aead.c
@@ -236,7 +236,10 @@ METHOD(aead_t, decrypt, bool,
 		default:
 			break;
 	}
-
+	if (!success && plain)
+	{
+		chunk_free(plain);
+	}
 	memwipe(nonce.ptr, nonce.len);
 	return success;
 }