From: Tobias Brunner <tobias@strongswan.org>
Date: Mon, 13 Jul 2026 17:21:41 +0000 (+0200)
Subject: tls-peer: Fix memory leak when processing Finished messages with TLS 1.3 fails
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4feb31d0e6bc2fc4b3aef165d662977fe675f2aa;p=thirdparty%2Fstrongswan.git

tls-peer: Fix memory leak when processing Finished messages with TLS 1.3 fails

Fixes: 7a2b02667c30 ("libtls: Implement TLS 1.3 handshake on client-side")
---

diff --git a/src/libtls/tls_peer.c b/src/libtls/tls_peer.c
index bfdba3eab3..ed2031128c 100644
--- a/src/libtls/tls_peer.c
+++ b/src/libtls/tls_peer.c
@@ -1013,7 +1013,7 @@ static status_t process_hello_done(private_tls_peer_t *this,
  */
 static status_t process_finished(private_tls_peer_t *this, bio_reader_t *reader)
 {
-	chunk_t received, verify_data;
+	chunk_t received, verify_data = chunk_empty;
 	u_char buf[12];
 
 	if (this->tls->get_version_max(this->tls) < TLS_1_3)
@@ -1040,7 +1040,7 @@ static status_t process_finished(private_tls_peer_t *this, bio_reader_t *reader)
 		{
 			DBG1(DBG_TLS, "calculating server finished failed");
 			this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
-			return NEED_MORE;
+			goto out;
 		}
 	}
 
@@ -1048,16 +1048,17 @@ static status_t process_finished(private_tls_peer_t *this, bio_reader_t *reader)
 	{
 		DBG1(DBG_TLS, "received server finished invalid");
 		this->alert->add(this->alert, TLS_FATAL, TLS_DECRYPT_ERROR);
-		return NEED_MORE;
+		goto out;
 	}
 
-	if (verify_data.ptr != buf)
+	this->crypto->append_handshake(this->crypto, TLS_FINISHED, received);
+	this->state = STATE_FINISHED_RECEIVED;
+
+out:
+	if (verify_data.ptr && verify_data.ptr != buf)
 	{
 		chunk_free(&verify_data);
 	}
-
-	this->crypto->append_handshake(this->crypto, TLS_FINISHED, received);
-	this->state = STATE_FINISHED_RECEIVED;
 	return NEED_MORE;
 }