commit ede381c808f501d6d2e99dd4d1beb9cd544d2b4c
author Neil Armstrong <narmstrong@baylibre.com> Tue Apr 05 10:02:59 2022 +0200
committer Neil Armstrong <narmstrong@baylibre.com> Tue Apr 05 10:33:01 2022 +0200
tree 658a418de61641ed63f88bef9e4ec6abe9a186a2
parent 3cae167e6ac2b2d1aec5ca070c4cab62c6af994b

Get PSK length & check for buffer size before writting in ECHDE-PSK PSA version of ssl_parse_client_key_exchange()

Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>

library/ssl_tls12_server.c

diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c
index d9a29dc..7b6efb1 100644
--- a/library/ssl_tls12_server.c
+++ b/library/ssl_tls12_server.c
@@ -4115,10 +4115,6 @@
         MBEDTLS_PUT_UINT16_BE( zlen, psm, 0 );
         psm += zlen_size + zlen;
 
-        /* opaque psk<0..2^16-1>; */
-        if( psm_end - psm < 2 )
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
-
         const unsigned char *psk = NULL;
         size_t psk_len = 0;
 
@@ -4130,13 +4126,14 @@
              */
             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
 
+        /* opaque psk<0..2^16-1>; */
+        if( (size_t)( psm_end - psm ) < ( 2 + psk_len ) )
+            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
+
         /* Write the PSK length as uint16 */
         MBEDTLS_PUT_UINT16_BE( psk_len, psm, 0 );
         psm += 2;
 
-        if( psm_end < psm || (size_t)( psm_end - psm ) < psk_len )
-            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
-
         /* Write the PSK itself */
         memcpy( psm, psk, psk_len );
         psm += psk_len;