From 023c6265251727d1fa7ecada45cb25a73e0d12fc Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 12 Jun 2026 16:40:05 +0200 Subject: [PATCH] openssl: Fix memory leak on failed ICV verification if not using in-place decryption Fixes: 81f9cd39fdf8 ("openssl: Provide AES-GCM implementation") --- src/libstrongswan/plugins/openssl/openssl_aead.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/libstrongswan/plugins/openssl/openssl_aead.c b/src/libstrongswan/plugins/openssl/openssl_aead.c index b7220bb6a..9a8481153 100644 --- a/src/libstrongswan/plugins/openssl/openssl_aead.c +++ b/src/libstrongswan/plugins/openssl/openssl_aead.c @@ -163,6 +163,7 @@ METHOD(aead_t, decrypt, bool, chunk_t *plain) { u_char *out; + bool valid; if (encrypted.len < this->icv_size) { @@ -176,7 +177,12 @@ METHOD(aead_t, decrypt, bool, *plain = chunk_alloc(encrypted.len); out = plain->ptr; } - return crypt_data(this, encrypted, assoc, iv, out, 0); + valid = crypt_data(this, encrypted, assoc, iv, out, 0); + if (!valid && plain) + { + chunk_free(plain); + } + return valid; } METHOD(aead_t, get_block_size, size_t,