From 677b915efe431d995a2e31f1573863ea9a43222f Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 14 Jul 2026 12:27:05 +0200 Subject: [PATCH] iv-manager: Don't allow zero max_ikev1_exchanges This would cause a use-after-free because `lookup_iv()` inserts, removes and destroys the still returned entry. Fixes: aeaab528e89c ("ikev1: Factor out IV and QM management") --- src/libcharon/sa/ikev1/iv_manager.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/libcharon/sa/ikev1/iv_manager.c b/src/libcharon/sa/ikev1/iv_manager.c index 53713fe56..d2f403fd3 100644 --- a/src/libcharon/sa/ikev1/iv_manager.c +++ b/src/libcharon/sa/ikev1/iv_manager.c @@ -352,6 +352,7 @@ iv_manager_t *iv_manager_create(int max_exchanges) { this->max_exchanges = lib->settings->get_int(lib->settings, "%s.max_ikev1_exchanges", MAX_EXCHANGES_DEFAULT, lib->ns); + this->max_exchanges = this->max_exchanges ?: MAX_EXCHANGES_DEFAULT; } return &this->public; }