From ad7d50f846c35067854e9d023d78f90acd62c3c5 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Sun, 12 Jul 2026 19:47:30 +0200 Subject: [PATCH] nm: Fix double-free of IKE config in error cases and some leaks and potential NULL dereferences --- src/charon-nm/nm/nm_service.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/src/charon-nm/nm/nm_service.c b/src/charon-nm/nm/nm_service.c index 3b6bf8969..e9ebe233b 100644 --- a/src/charon-nm/nm/nm_service.c +++ b/src/charon-nm/nm/nm_service.c @@ -107,6 +107,7 @@ static GVariant* handler_to_variant(nm_handler_t *handler, char *variant_type, configuration_attribute_type_t type) { GVariantBuilder builder; + GVariant *variant; enumerator_t *enumerator; chunk_t *chunk; @@ -115,7 +116,11 @@ static GVariant* handler_to_variant(nm_handler_t *handler, char *variant_type, enumerator = handler->create_enumerator(handler, type); while (enumerator->enumerate(enumerator, &chunk)) { - g_variant_builder_add_value (&builder, addr_to_variant(*chunk)); + variant = addr_to_variant(*chunk); + if (variant) + { + g_variant_builder_add_value (&builder, variant); + } } enumerator->destroy(enumerator); @@ -516,6 +521,7 @@ static chunk_t read_safe_file(NMStrongswanPluginPrivate *priv, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS, "Unable to open '%s': %s", safe_path, strerror(errno)); } + g_free(safe_path); } return chunk; } @@ -665,6 +671,7 @@ static bool add_auth_cfg_cert(NMStrongswanPluginPrivate *priv, safe_file = read_safe_file(priv, str, user, err); if (!safe_file.ptr) { + DESTROY_IF(cert); return FALSE; } private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, @@ -763,7 +770,7 @@ static bool add_auth_cfg_pw(NMStrongswanPluginPrivate *priv, str = nm_setting_vpn_get_secret(vpn, "password"); if (streq(method, "psk")) { - if (strlen(str) < 20) + if (!str || strlen(str) < 20) { g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS, @@ -1032,7 +1039,6 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection, if (!add_auth_cfg_cert(priv, vpn, peer_cfg, user, err)) { peer_cfg->destroy(peer_cfg); - ike_cfg->destroy(ike_cfg); gateway->destroy(gateway); return FALSE; } @@ -1043,7 +1049,6 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection, if (!add_auth_cfg_pw(priv, vpn, peer_cfg, err)) { peer_cfg->destroy(peer_cfg); - ike_cfg->destroy(ike_cfg); gateway->destroy(gateway); return FALSE; } @@ -1053,7 +1058,6 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection, g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS, "Configuration parameters missing."); peer_cfg->destroy(peer_cfg); - ike_cfg->destroy(ike_cfg); gateway->destroy(gateway); return FALSE; }