denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ccm: Fix memory leak on failed ICV verification if not using in-place decryption

Browse Source 
Fixes: 80a93a1335 ("Implemented a ccm plugin providing CCM mode based on CBC crypters")
This commit is contained in:
Tobias Brunner
2026-07-22 18:20:12 +02:00
parent 40aa0a12c4
commit 85c02dc16c
1 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/ccm/ccm_aead.c
+12 -7
View File
@@ -283,16 +283,21 @@ METHOD(aead_t, decrypt, bool,
return FALSE; return FALSE;
} }
encrypted.len -= this->icv_size; encrypted.len -= this->icv_size;
if (plain) if (!plain)
{ {
*plain = chunk_alloc(encrypted.len); return crypt_data(this, iv, encrypted, encrypted) &&
return crypt_data(this, iv, encrypted, *plain) && verify_icv(this, encrypted, assoc, iv,
verify_icv(this, *plain, assoc, iv,
encrypted.ptr + encrypted.len); encrypted.ptr + encrypted.len);
} }
return crypt_data(this, iv, encrypted, encrypted) && *plain = chunk_alloc(encrypted.len);
verify_icv(this, encrypted, assoc, iv, if (crypt_data(this, iv, encrypted, *plain) &&
encrypted.ptr + encrypted.len); verify_icv(this, *plain, assoc, iv,
encrypted.ptr + encrypted.len))
{
return TRUE;
}
chunk_free(plain);
return FALSE;
} }
METHOD(aead_t, get_block_size, size_t, METHOD(aead_t, get_block_size, size_t,