aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJanos Follath <janos.follath@arm.com>2016-04-21 23:37:09 +0100
committerSimon Butcher <simon.butcher@arm.com>2016-04-21 23:37:09 +0100
commitcb351d236d8f4592b17d67d04aba44665f6e9a99 (patch)
tree7d377f3c779e8155f715cfdf9578a3dd15412a71
parent8c4472af397c58c0a28416881f31229d554bdecd (diff)
downloadmbed-tls-iotssl-580-invalid-curves-crash.tar.gz
Fix bug in ssl_write_supported_elliptic_curves_extiotssl-580-invalid-curves-crasharchive/iotssl-580-invalid-curves-crash
Passing invalid curves to mbedtls_ssl_conf_curves potentially could caused a crash later in ssl_write_supported_elliptic_curves_ext. #373
-rw-r--r--ChangeLog2
-rw-r--r--library/ssl_cli.c7
2 files changed, 8 insertions, 1 deletions
diff --git a/ChangeLog b/ChangeLog
index e9b67908f..11cc52294 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,6 +11,8 @@ Bugfix
* Fix issue in Makefile that prevented building using armar. #386
* Fix memory leak that occured only when ECJPAKE was enabled and ECDHE and
ECDSA was disabled in config.h . The leak didn't occur by default.
+ * Fix issue that caused a crash if invalid curves were passed to
+ mbedtls_ssl_conf_curves. #373
Changes
* On ARM platforms, when compiling with -O0 with GCC, Clang or armcc5,
diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 4452169d9..785c01fbe 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -270,6 +270,12 @@ static void ssl_write_supported_elliptic_curves_ext( mbedtls_ssl_context *ssl,
for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ )
{
#endif
+ if( info == NULL )
+ {
+ MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid curve in ssl configuration" ) );
+ return;
+ }
+
elliptic_curve_len += 2;
}
@@ -289,7 +295,6 @@ static void ssl_write_supported_elliptic_curves_ext( mbedtls_ssl_context *ssl,
for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ )
{
#endif
-
elliptic_curve_list[elliptic_curve_len++] = info->tls_id >> 8;
elliptic_curve_list[elliptic_curve_len++] = info->tls_id & 0xFF;
}