Commit 16eff9cd5d for strongswan.org

commit 16eff9cd5ddf2c3d8d72e6f7c0d26685819db01c
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Mon Nov 2 09:24:49 2026 +0100

    des: Validate key sizes in constructor and setter

diff --git a/src/libstrongswan/plugins/des/des_crypter.c b/src/libstrongswan/plugins/des/des_crypter.c
index 086540c62e..6a564aa13b 100644
--- a/src/libstrongswan/plugins/des/des_crypter.c
+++ b/src/libstrongswan/plugins/des/des_crypter.c
@@ -1546,6 +1546,10 @@ METHOD(crypter_t, get_key_size, size_t,
 METHOD(crypter_t, set_key, bool,
 	private_des_crypter_t *this, chunk_t key)
 {
+	if (key.len != this->key_size)
+	{
+		return FALSE;
+	}
 	des_set_key((des_cblock*)(key.ptr), &this->ks);
 	return TRUE;
 }
@@ -1553,6 +1557,10 @@ METHOD(crypter_t, set_key, bool,
 METHOD(crypter_t, set_key3, bool,
 	private_des_crypter_t *this, chunk_t key)
 {
+	if (key.len != this->key_size)
+	{
+		return FALSE;
+	}
 	des_set_key((des_cblock*)(key.ptr) + 0, &this->ks3[0]);
 	des_set_key((des_cblock*)(key.ptr) + 1, &this->ks3[1]);
 	des_set_key((des_cblock*)(key.ptr) + 2, &this->ks3[2]);
@@ -1569,7 +1577,7 @@ METHOD(crypter_t, destroy, void,
 /*
  * Described in header
  */
-des_crypter_t *des_crypter_create(encryption_algorithm_t algo)
+des_crypter_t *des_crypter_create(encryption_algorithm_t algo, size_t key_size)
 {
 	private_des_crypter_t *this;

@@ -1609,5 +1617,10 @@ des_crypter_t *des_crypter_create(encryption_algorithm_t algo)
 			free(this);
 			return NULL;
 	}
+	if (key_size && key_size != this->key_size)
+	{
+		free(this);
+		return NULL;
+	}
 	return &this->public;
 }
diff --git a/src/libstrongswan/plugins/des/des_crypter.h b/src/libstrongswan/plugins/des/des_crypter.h
index d63d29368f..f90d5367a4 100644
--- a/src/libstrongswan/plugins/des/des_crypter.h
+++ b/src/libstrongswan/plugins/des/des_crypter.h
@@ -40,9 +40,9 @@ struct des_crypter_t {
  * Constructor to create des_crypter_t objects.
  *
  * @param algo		ENCR_DES for single DES, ENCR_3DES for triple DES
+ * @param key_size	key size in bytes
  * @return			des_crypter_t object, NULL if algo not supported
  */
-des_crypter_t *des_crypter_create(encryption_algorithm_t algo);
-
+des_crypter_t *des_crypter_create(encryption_algorithm_t algo, size_t key_size);

 #endif /** DES_CRYPTER_H_ @}*/