From 2c65dacf602c381d541f78bc05a73173f1a846ee Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 25 Jun 2026 16:20:24 +0200 Subject: [PATCH] me: Avoid crash when processing endpoint with invalid NO_FAMILY Such endpoints are used to request a peer reflexive endpoint, but are never expected in a response. Fixes: d5cc1758332e ("experimental P2P-NAT-T for IKEv2 merged back from branch") --- src/libcharon/sa/ikev2/connect_manager.c | 7 +++---- src/libcharon/sa/ikev2/tasks/ike_me.c | 8 ++++++-- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/src/libcharon/sa/ikev2/connect_manager.c b/src/libcharon/sa/ikev2/connect_manager.c index 63f20c493..37928727e 100644 --- a/src/libcharon/sa/ikev2/connect_manager.c +++ b/src/libcharon/sa/ikev2/connect_manager.c @@ -1262,13 +1262,12 @@ static void process_response(private_connect_manager_t *this, check_t *check, linked_list_t *local_endpoints = checklist->is_initiator ? checklist->initiator.endpoints : checklist->responder.endpoints; + host_t *host = check->endpoint->get_host(check->endpoint); endpoint_notify_t *local_endpoint; - if (!endpoints_contain(local_endpoints, - check->endpoint->get_host(check->endpoint), - &local_endpoint)) + if (host && !endpoints_contain(local_endpoints, host, &local_endpoint)) { local_endpoint = endpoint_notify_create_from_host(PEER_REFLEXIVE, - check->endpoint->get_host(check->endpoint), pair->local); + host, pair->local); local_endpoint->set_priority(local_endpoint, check->endpoint->get_priority(check->endpoint)); local_endpoints->insert_last(local_endpoints, local_endpoint); diff --git a/src/libcharon/sa/ikev2/tasks/ike_me.c b/src/libcharon/sa/ikev2/tasks/ike_me.c index 3339cb878..2d30ea1d9 100644 --- a/src/libcharon/sa/ikev2/tasks/ike_me.c +++ b/src/libcharon/sa/ikev2/tasks/ike_me.c @@ -477,8 +477,12 @@ METHOD(task_t, process_i, status_t, { /* FIXME: should we accept this endpoint even if we did not send * a request? */ host_t *endpoint = reflexive->get_host(reflexive); - endpoint = endpoint->clone(endpoint); - this->ike_sa->set_server_reflexive_host(this->ike_sa, endpoint); + if (endpoint) + { + endpoint = endpoint->clone(endpoint); + this->ike_sa->set_server_reflexive_host(this->ike_sa, + endpoint); + } } break; }