From fe6dc7d256ec11d15cc5836092595daf6885e677 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 19 Jun 2026 17:12:47 +0200 Subject: [PATCH] af-alg: Fix output offset if not all data was processed during en-/decryption If only parts of the total data could be written to the kernel, the result of the next read chunk would incorrectly get written at the beginning of the output buffer again. Also makes sure to close the accepted FD in error cases. Fixes: 1b5de7ce3bdd ("Use a generic AF_ALG wrapper for common operations") --- src/libstrongswan/plugins/af_alg/af_alg_ops.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/libstrongswan/plugins/af_alg/af_alg_ops.c b/src/libstrongswan/plugins/af_alg/af_alg_ops.c index d5d47ec69..4afd1bf4f 100644 --- a/src/libstrongswan/plugins/af_alg/af_alg_ops.c +++ b/src/libstrongswan/plugins/af_alg/af_alg_ops.c @@ -167,6 +167,7 @@ METHOD(af_alg_ops_t, crypt_, bool, continue; } DBG1(DBG_LIB, "writing to AF_ALG crypter failed: %s", strerror(errno)); + close(op); return FALSE; } while (read(op, out, len) != len) @@ -175,10 +176,12 @@ METHOD(af_alg_ops_t, crypt_, bool, { DBG1(DBG_LIB, "reading from AF_ALG crypter failed: %s", strerror(errno)); + close(op); return FALSE; } } data = chunk_skip(data, len); + out += len; /* no IV for subsequent data chunks */ msg.msg_controllen = 0; }