Fix double free when sites isn't defined

2 files changed, 34 insertions, 1 deletions

diff --git a/PKGBUILD b/PKGBUILD
index 31b350eb1b51..b24adc4b1647 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -14,17 +14,19 @@ depends=(openssl ncurses libedit)
 makedepends=(cmake)
 optdepends=(openldap)
 backup=(etc/iked.conf)
-source=("http://www.shrew.net/download/ike/ike-$pkgver-release.tgz" iked.service openssl-1.1.0.patch cmake-threadlib.patch)
+source=("http://www.shrew.net/download/ike/ike-$pkgver-release.tgz" iked.service openssl-1.1.0.patch cmake-threadlib.patch fix_double_free.patch)
 md5sums=('3dac18a2da5809ccb38c50cd4a455897'
          '3cb3ff3b663805f76be1efd527ae436c'
          '57348fe9112555c0204709c1716e5fff'
          '4c823bae9e006cf7bfb11fa633a59837'
+         '57f7f50b68020b5df6d54288757249c1'
          )
 
 prepare () {
     cd "$srcdir/ike"
     patch -p1 -i "$srcdir/openssl-1.1.0.patch"
     patch -p1 -i "$srcdir/cmake-threadlib.patch"
+    patch -p1 -i "$srcdir/fix_double_free.patch"
     sed -i 's/define "parser_class_name"/define parser_class_name/' ./source/iked/conf.parse.yy
 }
 
diff --git a/fix_double_free.patch b/fix_double_free.patch
new file mode 100644
index 000000000000..6482be191b50
--- /dev/null
+++ b/fix_double_free.patch
@@ -0,0 +1,31 @@
+diff --git a/old/source/ikec/main.cpp b/new/source/ikec/main.cpp
+index 488b92b..c6cf19b 100644
+--- a/source/ikec/main.cpp
++++ b/source/ikec/main.cpp
+@@ -72,7 +72,9 @@ int main( int argc, char ** argv )
+ 
+ 		if( ikec.auto_connect() )
+ 			ikec.vpn_connect( true );
+-	}
++	} else {
++            return 0;
++        }
+ 
+ 	// process user input
+ 
+diff --git a/old/source/libike/manager.file.cpp b/new/source/libike/manager.file.cpp
+index 113486a..42d2938 100644
+--- a/source/libike/manager.file.cpp
++++ b/source/libike/manager.file.cpp
+@@ -178,6 +178,11 @@ bool _CONFIG_MANAGER::file_vpn_load( CONFIG & config )
+ 	else

+ 		path.add( sites_user );

+ 

++        if (path.size() == 0) {

++            //Empty path. Below ins will fail with -1, so abort now.

++            return false;

++        }

++

+ 	path.ins( PATH_DELIM, 1, path.size() - 1 );

+ 	path.ins( config.get_id(), strlen( config.get_id() ), path.size() - 1 );

+