From 20b07f2cbf8c8dd7b6e815e096ab15f0b2eec290 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 25 Mar 2026 09:56:06 +0100 Subject: [PATCH] vici: Prevent uninitialized memory access if VICI_LIST_ITEM is too short If there is only a single length byte, `value` is not changed and points to uninitialized data. --- src/libcharon/plugins/vici/vici_message.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/libcharon/plugins/vici/vici_message.c b/src/libcharon/plugins/vici/vici_message.c index b0bd03eab..b982a5f4e 100644 --- a/src/libcharon/plugins/vici/vici_message.c +++ b/src/libcharon/plugins/vici/vici_message.c @@ -183,7 +183,11 @@ METHOD(enumerator_t, parse_enumerate, bool, this->list = TRUE; break; case VICI_LIST_ITEM: - this->reader->read_data16(this->reader, value); + if (!this->reader->read_data16(this->reader, value)) + { + DBG1(DBG_ENC, "invalid '%N' encoding", vici_type_names, type); + return FALSE; + } break; case VICI_LIST_END: this->list = FALSE;