commit db8b089cdcf96a41dc535f2b45f10cdb03e3af90
author Janos Follath <janos.follath@arm.com> Mon Feb 22 11:20:56 2016 +0000
committer Janos Follath <janos.follath@arm.com> Tue Mar 22 15:25:31 2016 +0000
tree b6fc25d30c47f527c9aeda6caf8b76a93ac028bb
parent 365b226a56f35371efaaa05795845fa952d6ee43

Fix bug in ssl_write_supported_elliptic_curves_ext

Passing invalid curves to mbedtls_ssl_conf_curves caused a crash later
in ssl_write_supported_elliptic_curves_ext. #373

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 017d6a2..8ef3951 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -9,6 +9,8 @@
    * Fix issue in Makefile that prevented building using armar. #386
    * Fix bug in mbedtls_x509_crt_parse that caused trailing extra data in the
      buffer after DER certificates to be included in the raw representation.
+   * Fix issue that caused a crash if invalid curves were passed to
+     mbedtls_ssl_conf_curves. #373
 
 Changes
    * On ARM platforms, when compiling with -O0 with GCC, Clang or armcc5,

library/ssl_cli.c

diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 09fc337..1d8b33f 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -269,6 +269,12 @@
     for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ )
     {
 #endif
+        if( info == NULL )
+        {
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid curve in ssl configuration" ) );
+            return;
+        }
+
         elliptic_curve_len += 2;
     }
 
@@ -288,7 +294,6 @@
     for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ )
     {
 #endif
-
         elliptic_curve_list[elliptic_curve_len++] = info->tls_id >> 8;
         elliptic_curve_list[elliptic_curve_len++] = info->tls_id & 0xFF;
     }