Commit 677b915efe for strongswan.org
commit 677b915efe431d995a2e31f1573863ea9a43222f
Author: Tobias Brunner <tobias@strongswan.org>
Date: Tue Jul 14 12:27:05 2026 +0200
iv-manager: Don't allow zero max_ikev1_exchanges
This would cause a use-after-free because `lookup_iv()` inserts, removes
and destroys the still returned entry.
Fixes: aeaab528e89c ("ikev1: Factor out IV and QM management")
diff --git a/src/libcharon/sa/ikev1/iv_manager.c b/src/libcharon/sa/ikev1/iv_manager.c
index 53713fe562..d2f403fd3c 100644
--- a/src/libcharon/sa/ikev1/iv_manager.c
+++ b/src/libcharon/sa/ikev1/iv_manager.c
@@ -352,6 +352,7 @@ iv_manager_t *iv_manager_create(int max_exchanges)
{
this->max_exchanges = lib->settings->get_int(lib->settings,
"%s.max_ikev1_exchanges", MAX_EXCHANGES_DEFAULT, lib->ns);
+ this->max_exchanges = this->max_exchanges ?: MAX_EXCHANGES_DEFAULT;
}
return &this->public;
}