From: Volker Rümelin <vr_strongswan@t-online.de>
Date: Fri, 11 Oct 2013 07:38:24 +0000 (+0200)
Subject: ikev1: Properly initialize list of fragments in case fragment ID is 0
X-Git-Tag: 5.1.1~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=643da9d2e6aa2fb3c91304fabc01340934228800;p=thirdparty%2Fstrongswan.git

ikev1: Properly initialize list of fragments in case fragment ID is 0

Fixes CVE-2013-6076.
---

diff --git a/src/libcharon/sa/ikev1/task_manager_v1.c b/src/libcharon/sa/ikev1/task_manager_v1.c
index 6d4ef14f4d..597416e36c 100644
--- a/src/libcharon/sa/ikev1/task_manager_v1.c
+++ b/src/libcharon/sa/ikev1/task_manager_v1.c
@@ -1273,7 +1273,7 @@ static status_t handle_fragment(private_task_manager_t *this, message_t *msg)
 		return FAILED;
 	}
 
-	if (this->frag.id != payload->get_id(payload))
+	if (!this->frag.list || this->frag.id != payload->get_id(payload))
 	{
 		clear_fragments(this, payload->get_id(payload));
 		this->frag.list = linked_list_create();