From 71fff07abaf67a956a33c419862795c8ee08f8c8 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Sun, 12 Jul 2026 16:41:41 +0200 Subject: [PATCH] charon-tkm: Fix potential use-after-free in chunk map This isn't a problem in practice as the nonces stored in the map are tied to the IKE SA that's currently checked out, so a found entry can't get removed/replaced concurrently. --- src/charon-tkm/src/tkm/tkm_chunk_map.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/charon-tkm/src/tkm/tkm_chunk_map.c b/src/charon-tkm/src/tkm/tkm_chunk_map.c index aea116c96..e9c0b8b64 100644 --- a/src/charon-tkm/src/tkm/tkm_chunk_map.c +++ b/src/charon-tkm/src/tkm/tkm_chunk_map.c @@ -89,16 +89,16 @@ METHOD(tkm_chunk_map_t, get_id, uint64_t, private_tkm_chunk_map_t * const this, chunk_t *data) { entry_t *entry; + uint64_t id = 0; + this->lock->read_lock(this->lock); entry = this->mappings->get(this->mappings, data); - this->lock->unlock(this->lock); - - if (!entry) + if (entry) { - return 0; + id = entry->value; } - - return entry->value; + this->lock->unlock(this->lock); + return id; } METHOD(tkm_chunk_map_t, remove_, bool,