From: Tobias Brunner <tobias@strongswan.org>
Date: Fri, 12 Jun 2026 14:23:40 +0000 (+0200)
Subject: esp-packet: Fix leak and avoid one if AEAD implementations misbehave
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=dae65dd4924ee331f1ee54a0cda54b5f6777bcbd;p=thirdparty%2Fstrongswan.git

esp-packet: Fix leak and avoid one if AEAD implementations misbehave

If an `aead_t` implementation incorrectly allocates memory if the
decryption/ICV verification failed, this avoids a leak.  Unfortunately,
many implementations actually did that.

Fixes: 24a8d1253fe4 ("libipsec: Wrap traditional algorithms in AEAD wrapper")
---

diff --git a/src/libipsec/esp_packet.c b/src/libipsec/esp_packet.c
index b19dc9d7d4..46a8dfcf6d 100644
--- a/src/libipsec/esp_packet.c
+++ b/src/libipsec/esp_packet.c
@@ -229,7 +229,7 @@ METHOD(esp_packet_t, decrypt, status_t,
 {
 	bio_reader_t *reader;
 	uint32_t spi, seq;
-	chunk_t data, iv, icv, aad, ciphertext, plaintext;
+	chunk_t data, iv, icv, aad, ciphertext, plaintext = chunk_empty;
 	aead_t *aead;
 
 	DESTROY_IF(this->payload);
@@ -246,6 +246,7 @@ METHOD(esp_packet_t, decrypt, status_t,
 		reader->remaining(reader) % aead->get_block_size(aead))
 	{
 		DBG1(DBG_ESP, "ESP decryption failed: invalid length");
+		reader->destroy(reader);
 		return PARSE_ERROR;
 	}
 	ciphertext = reader->peek(reader);
@@ -269,6 +270,7 @@ METHOD(esp_packet_t, decrypt, status_t,
 	if (!aead->decrypt(aead, ciphertext, aad, iv, &plaintext))
 	{
 		DBG1(DBG_ESP, "ESP decryption or ICV verification failed");
+		chunk_free(&plaintext);
 		return FAILED;
 	}
 	esp_context->set_authenticated_seqno(esp_context, seq);