libreswan/libreswan-4.15-CVE-2026-12413.patch
Daiki Ueno 936e2d3050 Backport fixes for CVE-2026-12413, CVE-2026-50721 and CVE-2026-50722
Resolves: RHEL-190120
Resolves: RHEL-190125
Resolves: RHEL-190155
Signed-off-by: Daiki Ueno <dueno@redhat.com>
2026-07-07 20:22:15 +09:00

14 lines
615 B
Diff

diff --git a/programs/pluto/ikev2_message.c b/programs/pluto/ikev2_message.c
index 84b289ca8f..a691346218 100644
--- a/programs/pluto/ikev2_message.c
+++ b/programs/pluto/ikev2_message.c
@@ -1000,7 +1000,7 @@ struct msg_digest *reassemble_v2_incoming_fragments(struct v2_incoming_fragments
passert(md->chain[ISAKMP_NEXT_v2SK] == NULL);
passert(md->chain[ISAKMP_NEXT_v2SKF] != NULL);
pexpect(md->chain[ISAKMP_NEXT_v2SKF]->payload.v2skf.isaskf_number == 1);
- passert(md->digest_roof < elemsof(md->digest));
+ passert(md->digest_roof <= elemsof(md->digest));
/*
* Pass 1: Compute the total payload size.