From 85c02dc16c04f0cf516ccf1a5abd8e5fd7fc032a Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 12 Jun 2026 16:44:58 +0200 Subject: [PATCH] ccm: Fix memory leak on failed ICV verification if not using in-place decryption Fixes: 80a93a133566 ("Implemented a ccm plugin providing CCM mode based on CBC crypters") --- src/libstrongswan/plugins/ccm/ccm_aead.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/src/libstrongswan/plugins/ccm/ccm_aead.c b/src/libstrongswan/plugins/ccm/ccm_aead.c index a155e2f42..dc6d8fbfe 100644 --- a/src/libstrongswan/plugins/ccm/ccm_aead.c +++ b/src/libstrongswan/plugins/ccm/ccm_aead.c @@ -283,16 +283,21 @@ METHOD(aead_t, decrypt, bool, return FALSE; } encrypted.len -= this->icv_size; - if (plain) + if (!plain) { - *plain = chunk_alloc(encrypted.len); - return crypt_data(this, iv, encrypted, *plain) && - verify_icv(this, *plain, assoc, iv, + return crypt_data(this, iv, encrypted, encrypted) && + verify_icv(this, encrypted, assoc, iv, encrypted.ptr + encrypted.len); } - return crypt_data(this, iv, encrypted, encrypted) && - verify_icv(this, encrypted, assoc, iv, - encrypted.ptr + encrypted.len); + *plain = chunk_alloc(encrypted.len); + if (crypt_data(this, iv, encrypted, *plain) && + verify_icv(this, *plain, assoc, iv, + encrypted.ptr + encrypted.len)) + { + return TRUE; + } + chunk_free(plain); + return FALSE; } METHOD(aead_t, get_block_size, size_t,