denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tls-peer: Fix memory leak when processing Finished messages with TLS 1.3 fails

Browse Source 
Fixes: 7a2b02667c ("libtls: Implement TLS 1.3 handshake on client-side")
This commit is contained in:
Tobias Brunner
2026-07-24 08:47:35 +02:00
parent be0ee2e806
commit 4feb31d0e6
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls_peer.c
+9 -8
View File
@@ -1013,7 +1013,7 @@ static status_t process_hello_done(private_tls_peer_t *this,
*/
static status_t process_finished(private_tls_peer_t *this, bio_reader_t *reader)
{
chunk_t received, verify_data;
chunk_t received, verify_data = chunk_empty;
u_char buf[12];
if (this->tls->get_version_max(this->tls) < TLS_1_3)
@@ -1040,7 +1040,7 @@ static status_t process_finished(private_tls_peer_t *this, bio_reader_t *reader)
{
DBG1(DBG_TLS, "calculating server finished failed");
this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
return NEED_MORE;
goto out;
}
}
@@ -1048,16 +1048,17 @@ static status_t process_finished(private_tls_peer_t *this, bio_reader_t *reader)
{
DBG1(DBG_TLS, "received server finished invalid");
this->alert->add(this->alert, TLS_FATAL, TLS_DECRYPT_ERROR);
return NEED_MORE;
}
if (verify_data.ptr != buf)
{
chunk_free(&verify_data);
goto out;
}
this->crypto->append_handshake(this->crypto, TLS_FINISHED, received);
this->state = STATE_FINISHED_RECEIVED;
out:
if (verify_data.ptr && verify_data.ptr != buf)
{
chunk_free(&verify_data);
}
return NEED_MORE;
}