mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2025-12-24 17:41:01 +03:00
Fix bug in mbedtls_asn1_store_named_data()
When passed a zero-length val, the function was free-ing the buffer as
the documentation suggests:
* \param val_len The minimum length of the data buffer needed.
* If this is 0, do not allocate a buffer for the associated
* data.
* If the OID was already present, enlarge, shrink or free
* the existing buffer to fit \p val_len.
However it kept the previous length, leaving the val structure in the
corresponding item in the output list in an inconsistent state:
p == NULL but len != 0
As a result, functions that would try using this item in the list
(including the same function!) afterwards would trip an dereference the
NULL pointer.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
@@ -412,6 +412,7 @@ mbedtls_asn1_named_data *mbedtls_asn1_store_named_data(
|
||||
} else if (val_len == 0) {
|
||||
mbedtls_free(cur->val.p);
|
||||
cur->val.p = NULL;
|
||||
cur->val.len = 0;
|
||||
} else if (cur->val.len != val_len) {
|
||||
/*
|
||||
* Enlarge existing value buffer if needed
|
||||
|
||||
Reference in New Issue
Block a user