Splitting buffers comment added
Signed-off-by: Shelly Liberman <shelly.liberman@arm.com>
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 3f4ac74..1ee7af0 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -11272,13 +11272,17 @@
mbedtls_platform_memcpy( ssl->out_msg, buf, len );
#if defined(MBEDTLS_FI_COUNTERMEASURES) && !defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
+ /*
+ * Buffer pointer and size duplication cannot be supported with MBEDTLS_SSL_CBC_RECORD_SPLITTING.
+ * After splitting pointers and data size will not be the same as initaly provides by user.
+ */
/* Secure against buffer substitution */
- if (buf == ssl->out_msg_dup &&
+ if( buf == ssl->out_msg_dup &&
ssl->out_msglen == ssl->out_msglen_dup &&
ssl->out_msg_dup[0] == ssl->out_msg[0] )
{/*write record only if data was copied from correct user pointer */
#endif
- if ( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
+ if( ( ret = mbedtls_ssl_write_record( ssl, SSL_FORCE_FLUSH ) ) != 0 )
{
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
return( ret );
@@ -11350,6 +11354,10 @@
{
int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
#if defined(MBEDTLS_FI_COUNTERMEASURES) && !defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING)
+ /*
+ * Buffer pointer and size duplication cannot be supported with MBEDTLS_SSL_CBC_RECORD_SPLITTING.
+ * After splitting pointers and data size will not be the same as initaly provides by user.
+ */
volatile const unsigned char *buf_dup = buf;
volatile size_t len_dup = len;
#endif
@@ -11379,7 +11387,7 @@
ret = ssl_write_split( ssl, buf, len );
#else
#if defined(MBEDTLS_FI_COUNTERMEASURES)
- /*Add const user pointers to context. We will be able to check its validity before copy to context*/
+ /* Add const user pointers to context. We will be able to check its validity before copy to context */
ssl->out_msg_dup = (unsigned char*)buf_dup;
ssl->out_msglen_dup = len_dup;
#endif //MBEDTLS_FI_COUNTERMEASURES