botan: Fix memory leak on failed ICV verification if not using in-place decryption

Fixes: af26cc4d85 ("botan: Add Botan plugin to libstrongswan")
2026-07-22 18:20:12 +02:00
parent a2f83d3075
commit 40aa0a12c4
1 changed files with 8 additions and 2 deletions
@@ -164,6 +164,7 @@ METHOD(aead_t, decrypt, bool,
 	chunk_t *plain)
 {
 	u_char *out;
+	bool valid;

 	if (encrypted.len < this->icv_size)
 	{
@@ -177,8 +178,13 @@ METHOD(aead_t, decrypt, bool,
 		*plain = chunk_alloc(encrypted.len);
 		out = plain->ptr;
 	}
-	return do_crypt(this, encrypted, assoc, iv, out,
-					BOTAN_CIPHER_INIT_FLAG_DECRYPT);
+	valid = do_crypt(this, encrypted, assoc, iv, out,
+					 BOTAN_CIPHER_INIT_FLAG_DECRYPT);
+	if (!valid && plain)
+	{
+		chunk_free(plain);
+	}
+	return valid;
 }

 METHOD(aead_t, get_block_size, size_t,