From caf81bc05c91b84e3b24cb3576cf00d966244053 Mon Sep 17 00:00:00 2001 From: Rob Shearman Date: Thu, 14 Nov 2024 13:15:36 +0000 Subject: [PATCH] child-create: Fix double free of list of labels after migrate If a migrate of a child-create occurs then labels_i and labels_r are freed, but the pointers are left set. If the task is subsequently destroyed without being reused, then both of these will be double freed. Fix this by setting labels_i and labels_r to NULL in the migrate method after freeing, similar to other fields that are freed. Closes strongswan/strongswan#2552 Fixes: f9b895b49f49 ("child-create: Add support to handle security labels") --- src/libcharon/sa/ikev2/tasks/child_create.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/libcharon/sa/ikev2/tasks/child_create.c b/src/libcharon/sa/ikev2/tasks/child_create.c index e6ada722f..05e743c86 100644 --- a/src/libcharon/sa/ikev2/tasks/child_create.c +++ b/src/libcharon/sa/ikev2/tasks/child_create.c @@ -2607,6 +2607,8 @@ METHOD(task_t, migrate, void, this->proposals = NULL; this->tsi = NULL; this->tsr = NULL; + this->labels_i = NULL; + this->labels_r = NULL; this->ke = NULL; this->nonceg = NULL; this->child_sa = NULL;