charon-tkm: Fix potential use-after-free in chunk map

This isn't a problem in practice as the nonces stored in the map are
tied to the IKE SA that's currently checked out, so a found entry can't
get removed/replaced concurrently.
This commit is contained in:
Tobias Brunner
2026-07-24 08:47:38 +02:00
parent 4224c3f647
commit 71fff07aba
+6 -6
View File
@@ -89,16 +89,16 @@ METHOD(tkm_chunk_map_t, get_id, uint64_t,
private_tkm_chunk_map_t * const this, chunk_t *data) private_tkm_chunk_map_t * const this, chunk_t *data)
{ {
entry_t *entry; entry_t *entry;
uint64_t id = 0;
this->lock->read_lock(this->lock); this->lock->read_lock(this->lock);
entry = this->mappings->get(this->mappings, data); entry = this->mappings->get(this->mappings, data);
this->lock->unlock(this->lock); if (entry)
if (!entry)
{ {
return 0; id = entry->value;
} }
this->lock->unlock(this->lock);
return entry->value; return id;
} }
METHOD(tkm_chunk_map_t, remove_, bool, METHOD(tkm_chunk_map_t, remove_, bool,