Commit 23c9b9a270 for strongswan.org

commit 23c9b9a2708e4958292d828424523fa63c0be829
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Fri Jun 12 15:55:43 2026 +0200

    x509: Fix memory leak when parsing directoryName in attribute certificates

    This can be triggered by an attribute certificate with lots of GeneralName
    entries.  There is no verification before the certificate is parsed.

    Fixes: 3134379ac7f1 ("x509: Fix some whitespaces and do some minor style cleanups in acert")
    Fixes: CVE-2026-78131

diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c
index 3fc5de2f11..ea5021a2aa 100644
--- a/src/libstrongswan/plugins/x509/x509_ac.c
+++ b/src/libstrongswan/plugins/x509/x509_ac.c
@@ -186,41 +186,25 @@ extern bool x509_parse_generalNames(chunk_t blob, int level0, bool implicit,
 static bool parse_directoryName(chunk_t blob, int level, bool implicit,
 								identification_t **name)
 {
-	identification_t *directoryName;
-	enumerator_t *enumerator;
-	bool first = TRUE;
 	linked_list_t *list;

 	list = linked_list_create();
 	if (!x509_parse_generalNames(blob, level, implicit, list))
 	{
-		list->destroy(list);
+		list->destroy_offset(list, offsetof(identification_t, destroy));
 		return FALSE;
 	}
-
-	enumerator = list->create_enumerator(list);
-	while (enumerator->enumerate(enumerator, &directoryName))
-	{
-		if (first)
-		{
-			*name = directoryName;
-			first = FALSE;
-		}
-		else
-		{
-			DBG1(DBG_ASN, "more than one directory name - first selected");
-			directoryName->destroy(directoryName);
-			break;
-		}
-	}
-	enumerator->destroy(enumerator);
-	list->destroy(list);
-
-	if (first)
+	if (list->remove_first(list, (void**)name) != SUCCESS)
 	{
 		DBG1(DBG_ASN, "no directoryName found");
+		list->destroy(list);
 		return FALSE;
 	}
+	if (list->get_count(list))
+	{
+		DBG1(DBG_ASN, "more than one directory name - first selected");
+	}
+	list->destroy_offset(list, offsetof(identification_t, destroy));
 	return TRUE;
 }