From e03ec46466822aabaaaad1849fa16ddc33899632 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Sun, 12 Jul 2026 17:18:47 +0200 Subject: [PATCH] vici: Fix memory leaks if loading CA cert in authority section fails The return value is now also fixed. The reply allocation previously prevented that sections with failed CA certs were rejected. Also fixes two potential leaks if duplicate settings are sent by a VICI client. Fixes: 63d370387d41 ("vici: Certification Authority support added.") --- src/libcharon/plugins/vici/vici_authority.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/libcharon/plugins/vici/vici_authority.c b/src/libcharon/plugins/vici/vici_authority.c index e79fc2816..378d013ee 100644 --- a/src/libcharon/plugins/vici/vici_authority.c +++ b/src/libcharon/plugins/vici/vici_authority.c @@ -325,8 +325,8 @@ CALLBACK(parse_string, bool, { return FALSE; } + free(*str); *str = strndup(v.ptr, v.len); - return TRUE; } @@ -383,16 +383,18 @@ CALLBACK(parse_cacert, bool, BUILD_BLOB_PEM, v, BUILD_END); if (!cert) { - return create_reply("parsing %N certificate failed", - certificate_type_names, CERT_X509); + return FALSE; } x509 = (x509_t*)cert; if ((x509->get_flags(x509) & X509_CA) != X509_CA) { + DBG1(DBG_CFG, "certificate in authority section lacks CA basic " + "constraint, rejected"); cert->destroy(cert); - return create_reply("certificate without CA flag, rejected"); + return FALSE; } + DESTROY_IF(*cacert); *cacert = cert; return TRUE;