From e535e130796ab708611df310ed991c072902fe30 Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Fri, 13 Mar 2026 09:35:28 +0100
Subject: [PATCH] vici: Prevent uninitialized memory access when finding
 VICI_END in message

VICI_END (7) shouldn't be encoded in a message.  However, if we encounter
it, we should at least set `out` accordingly so callers can abort the
enumeration.  By not doing so previously and returning TRUE, callers
might access the possibly uninitialized name/value arguments passed to
the enumerator.
---
 src/libcharon/plugins/vici/vici_message.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libcharon/plugins/vici/vici_message.c b/src/libcharon/plugins/vici/vici_message.c
index 546b7caeb..b0bd03eab 100644
--- a/src/libcharon/plugins/vici/vici_message.c
+++ b/src/libcharon/plugins/vici/vici_message.c
@@ -189,7 +189,7 @@ METHOD(enumerator_t, parse_enumerate, bool,
 			this->list = FALSE;
 			break;
 		case VICI_END:
-			return TRUE;
+			break;
 		default:
 			DBG1(DBG_ENC, "unknown encoding type: %u", type);
 			return FALSE;