Hide Forgot
=> openswan-2.6.32/programs/pluto/ike_alg.c:87 when ike_alg_get_encrypter returns NULL (line 82) there is NULL dereference on 87 when asking for enc_desc->keyminlen. There is probably else keyword missing on line 87 (else-if statement). a) if ike_alg_get_encrypter fails on line 82 b) enc_desc is dereferenced on line 87. This problem was newly found in RHEL 5.8 by Coverity difference scan on RHEL packages 5.7 → 5.8. version: openswan-2.6.32
I looked at the code, and that seems like a false alarm. As the code checks for enc_desc is null or not before dereferencing it and return false. So this seems like a not a bug.
Avesh, there is a bug there enc_desc = ike_alg_get_encrypter(ealg); suppose this is NULL if (!enc_desc) { It goes in here /* failure: encrypt algo must be present */ snprintf(ugh_buf, ugh_buf_len, "encrypt algo not found"); ret = FALSE; it does not return, so it hits the next line } if ((key_len) && ((key_len < enc_desc->keyminlen) segfaults here because it probably should be else if so that it skips over this block
Steve you are right, I mislooked it thinking ret=false is a return statement. i think that needs to be corrected.
This is cloned to bz 747966 for 6.2.
Fix commited, will be in openswan 2.6.37
note that ike_alg_get_encrypter() never returns NULL though...
This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux release for currently deployed products. This request is not yet committed for inclusion in a release.
This is already fixed as part of released openswan version in 5.9, so closing this.
Re-opening for rhel-5.10.0 as it has not yet been fixed in 5.9 despite comment #13 claiming so.