cuberite/polarssl
1
0
Fork 0
mirror of https://github.com/cuberite/polarssl.git synced 2025-11-04 04:32:24 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix potential double-free in ssl_conf_psk()

Browse Source
This commit is contained in:
Manuel Pégourié-Gonnard 2015-10-20 19:56:45 +02:00
parent c8cd2c6577
commit 173c790722
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,5 +1,12 @@
mbed TLS ChangeLog (Sorted per branch, date) mbed TLS ChangeLog (Sorted per branch, date)
= mbed TLS 2.2.0 released 2015-10-xx
Security
* Fix potential double free if mbedtls_ssl_conf_psk() is called more than
once and some allocation fails. Cannot be forced remotely. Found by Guido
Vranken, Intelworks.
= mbed TLS 2.1.2 released 2015-10-06 = mbed TLS 2.1.2 released 2015-10-06
Security Security

2
library/ssl_tls.c
View File

@ -5701,6 +5701,8 @@ int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
{ {
mbedtls_free( conf->psk ); mbedtls_free( conf->psk );
mbedtls_free( conf->psk_identity ); mbedtls_free( conf->psk_identity );
conf->psk = NULL;
conf->psk_identity = NULL;
} }
if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL || if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL ||