denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

imv-scanner: Fix potentially unsafe port filter attribute destruction

Browse Source 
DESTROY_IF() checks if the given value is not NULL, before calling
destroy() on it, which does not work for sub-structs.  If
port_filter_attr is NULL, this could crash.
This commit is contained in:
Tobias Brunner
2020-12-03 12:19:06 +01:00
parent 25ec2d04aa
commit eb4cd8e3b1
1 changed files with 16 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libimcv/plugins/imv_scanner/imv_scanner_state.c
+16 -4
View File
@@ -321,8 +321,12 @@ METHOD(imv_state_t, reset, void,
this->handshake_state = IMV_SCANNER_STATE_INIT;
DESTROY_IF(&this->port_filter_attr->pa_tnc_attribute);
this->port_filter_attr = NULL;
if (this->port_filter_attr)
{
this->port_filter_attr->pa_tnc_attribute.destroy(
&this->port_filter_attr->pa_tnc_attribute);
this->port_filter_attr = NULL;
}
this->violating_ports->destroy_function(this->violating_ports, free);
this->violating_ports = linked_list_create();
}
@@ -333,7 +337,11 @@ METHOD(imv_state_t, destroy, void,
DESTROY_IF(this->session);
DESTROY_IF(this->reason_string);
DESTROY_IF(this->remediation_string);
DESTROY_IF(&this->port_filter_attr->pa_tnc_attribute);
if (this->port_filter_attr)
{
this->port_filter_attr->pa_tnc_attribute.destroy(
&this->port_filter_attr->pa_tnc_attribute);
}
this->contracts->destroy(this->contracts);
this->violating_ports->destroy_function(this->violating_ports, free);
free(this);
@@ -354,7 +362,11 @@ METHOD(imv_scanner_state_t, get_handshake_state, imv_scanner_handshake_state_t,
METHOD(imv_scanner_state_t, set_port_filter_attr, void,
private_imv_scanner_state_t *this, ietf_attr_port_filter_t *attr)
{
DESTROY_IF(&this->port_filter_attr->pa_tnc_attribute);
if (this->port_filter_attr)
{
this->port_filter_attr->pa_tnc_attribute.destroy(
&this->port_filter_attr->pa_tnc_attribute);
}
this->port_filter_attr = attr;
}