group_get() can fail and return NULL. dh_getlen() accesses ie->group,
so this will crash. Not sure if this is actually reachable, but it seems
wrong. I've done what's done nearby. I don't want to look too closely...

Index: ike_quick_mode.c
===================================================================
RCS file: /cvs/src/sbin/isakmpd/ike_quick_mode.c,v
retrieving revision 1.114
diff -u -p -U6 -r1.114 ike_quick_mode.c
--- ike_quick_mode.c    15 Jan 2018 09:54:48 -0000      1.114
+++ ike_quick_mode.c    31 Mar 2023 07:31:44 -0000
@@ -890,12 +890,14 @@ initiator_send_HASH_SA_NONCE(struct mess
        if (exchange_gen_nonce(msg, 16))
                return -1;
 
        /* Generate optional KEY_EXCH payload.  */
        if (group_desc > 0) {
                ie->group = group_get(group_desc);
+               if (!ie_group)
+                       return -1;
                ie->g_x_len = dh_getlen(ie->group);
 
                if (ipsec_gen_g_x(msg)) {
                        group_free(ie->group);
                        ie->group = 0;
                        return -1;

Reply via email to