commit daf375aa8be4658a92e3b917fef353ac4a47d750
author Jerry Yu <jerry.h.yu@arm.com> Wed Jul 20 21:31:43 2022 +0800
committer Jerry Yu <jerry.h.yu@arm.com> Thu Jul 21 16:19:50 2022 +0800
tree 9960e83628715e0f08e462543104744b01dfc0dd
parent bb852029f4d18290be111c943b290d173d72d09b

fix issues of check_binder_match

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>

library/ssl_tls13_server.c

diff --git a/library/ssl_tls13_server.c b/library/ssl_tls13_server.c
index 4d8302b..c50b202 100644
--- a/library/ssl_tls13_server.c
+++ b/library/ssl_tls13_server.c
@@ -146,14 +146,11 @@
     mbedtls_md_type_t md_alg =
         binder_len == 32 ? MBEDTLS_MD_SHA256 : MBEDTLS_MD_SHA384 ;
     psa_algorithm_t psa_md_alg = mbedtls_psa_translate_md( md_alg );
-    unsigned char transcript[MBEDTLS_MD_MAX_SIZE];
+    unsigned char transcript[PSA_HASH_MAX_SIZE];
     size_t transcript_len;
-    unsigned char server_computed_binder[MBEDTLS_MD_MAX_SIZE];
+    unsigned char server_computed_binder[PSA_HASH_MAX_SIZE];
 
-    if( ssl->handshake->resume == 1 )
-        psk_type = MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION;
-    else
-        psk_type = MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL;
+    psk_type = MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL;
 
     /* Get current state of handshake transcript. */
     ret = mbedtls_ssl_get_handshake_transcript( ssl, md_alg,
@@ -182,6 +179,8 @@
         return( SSL_TLS1_3_OFFERED_PSK_MATCH );
     }
 
+    mbedtls_platform_zeroize( server_computed_binder,
+                              sizeof( server_computed_binder ) );
     return( SSL_TLS1_3_OFFERED_PSK_NOT_MATCH );
 }
 /* Parser for pre_shared_key extension in client hello