denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pt-tls-server: Don't store PT-TLS message on stack

Browse Source 
The size of that buffer was ~2 MB, which is not ideal for systems
with restricted stack sizes.
This commit is contained in:
Tobias Brunner
2026-07-24 08:47:38 +02:00
parent 268c11fa8c
commit 3150e61e00
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libpttls/pt_tls_server.c
+8 -1
View File
@@ -406,7 +406,7 @@ static status_t assess(private_pt_tls_server_t *this, tls_t *tnccs)
{ {
size_t msglen; size_t msglen;
size_t buflen = PT_TLS_MAX_MESSAGE_LEN; size_t buflen = PT_TLS_MAX_MESSAGE_LEN;
char buf[buflen]; char *buf;
bio_reader_t *reader; bio_reader_t *reader;
uint32_t vendor, type, identifier; uint32_t vendor, type, identifier;
chunk_t data; chunk_t data;
@@ -451,6 +451,11 @@ static status_t assess(private_pt_tls_server_t *this, tls_t *tnccs)
} }
reader->destroy(reader); reader->destroy(reader);
buf = malloc(buflen);
if (!buf)
{
return FAILED;
}
status = tnccs->build(tnccs, buf, &buflen, &msglen); status = tnccs->build(tnccs, buf, &buflen, &msglen);
if (status == ALREADY_DONE) if (status == ALREADY_DONE)
{ {
@@ -458,9 +463,11 @@ static status_t assess(private_pt_tls_server_t *this, tls_t *tnccs)
if (!pt_tls_write(this->tls, PT_TLS_PB_TNC_BATCH, if (!pt_tls_write(this->tls, PT_TLS_PB_TNC_BATCH,
this->identifier++, data)) this->identifier++, data))
{ {
free(buf);
return FAILED; return FAILED;
} }
} }
free(buf);
return status; return status;
} }