Commit 3150e61e00 for strongswan.org

commit 3150e61e005750f9aa874f4c8fce297414d254a9
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Sun Jul 12 19:15:31 2026 +0200

    pt-tls-server: Don't store PT-TLS message on stack

    The size of that buffer was ~2 MB, which is not ideal for systems
    with restricted stack sizes.

diff --git a/src/libpttls/pt_tls_server.c b/src/libpttls/pt_tls_server.c
index d33a362122..b9baead54f 100644
--- a/src/libpttls/pt_tls_server.c
+++ b/src/libpttls/pt_tls_server.c
@@ -406,7 +406,7 @@ static status_t assess(private_pt_tls_server_t *this, tls_t *tnccs)
 {
 	size_t msglen;
 	size_t buflen = PT_TLS_MAX_MESSAGE_LEN;
-	char buf[buflen];
+	char *buf;
 	bio_reader_t *reader;
 	uint32_t vendor, type, identifier;
 	chunk_t data;
@@ -451,6 +451,11 @@ static status_t assess(private_pt_tls_server_t *this, tls_t *tnccs)
 	}
 	reader->destroy(reader);

+	buf = malloc(buflen);
+	if (!buf)
+	{
+		return FAILED;
+	}
 	status = tnccs->build(tnccs, buf, &buflen, &msglen);
 	if (status == ALREADY_DONE)
 	{
@@ -458,9 +463,11 @@ static status_t assess(private_pt_tls_server_t *this, tls_t *tnccs)
 		if (!pt_tls_write(this->tls, PT_TLS_PB_TNC_BATCH,
 						  this->identifier++, data))
 		{
+			free(buf);
 			return FAILED;
 		}
 	}
+	free(buf);
 	return status;
 }