From 11241a837902da354074729eca357e35ef4fbee1 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 20 Jul 2026 12:29:21 +0200 Subject: [PATCH] encrypted-payload: Do basic decryption check only once The check only references the original chunk, so for each parsed payload it checks the same thing. The length of each individual payload is checked by the parser anyway. So I think this was primarily added for the IKEv1 "wrong PSK" use case. Let's keep it for now. Fixes: dd5c3787dc38 ("Give a hint that decryption failed if payload length invalid") --- .../encoding/payloads/encrypted_payload.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/src/libcharon/encoding/payloads/encrypted_payload.c b/src/libcharon/encoding/payloads/encrypted_payload.c index 4ac7aba94..1e22d0831 100644 --- a/src/libcharon/encoding/payloads/encrypted_payload.c +++ b/src/libcharon/encoding/payloads/encrypted_payload.c @@ -575,22 +575,22 @@ METHOD(encrypted_payload_t, encrypt_v1, status_t, static status_t parse(private_encrypted_payload_t *this, chunk_t plain) { parser_t *parser; - payload_type_t type; + payload_type_t type = this->next_payload; + + if (type != PL_NONE && + (plain.len < 4 || untoh16(plain.ptr + 2) > plain.len)) + { + DBG1(DBG_ENC, "invalid %N payload length, decryption failed?", + payload_type_names, type); + return PARSE_ERROR; + } parser = parser_create(plain); parser->set_major_version(parser, this->type == PLV1_ENCRYPTED ? 1 : 2); - type = this->next_payload; while (type != PL_NONE) { payload_t *payload; - if (plain.len < 4 || untoh16(plain.ptr + 2) > plain.len) - { - DBG1(DBG_ENC, "invalid %N payload length, decryption failed?", - payload_type_names, type); - parser->destroy(parser); - return PARSE_ERROR; - } if (parser->parse_payload(parser, type, &payload) != SUCCESS) { parser->destroy(parser);