mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2025-07-30 22:43:08 +03:00
Fix bug in mbedtls_asn1_store_named_data()
When passed a zero-length val, the function was free-ing the buffer as the documentation suggests: * \param val_len The minimum length of the data buffer needed. * If this is 0, do not allocate a buffer for the associated * data. * If the OID was already present, enlarge, shrink or free * the existing buffer to fit \p val_len. However it kept the previous length, leaving the val structure in the corresponding item in the output list in an inconsistent state: p == NULL but len != 0 As a result, functions that would try using this item in the list (including the same function!) afterwards would trip an dereference the NULL pointer. Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
@ -412,6 +412,7 @@ mbedtls_asn1_named_data *mbedtls_asn1_store_named_data(
|
||||
} else if (val_len == 0) {
|
||||
mbedtls_free(cur->val.p);
|
||||
cur->val.p = NULL;
|
||||
cur->val.len = 0;
|
||||
} else if (cur->val.len != val_len) {
|
||||
/*
|
||||
* Enlarge existing value buffer if needed
|
||||
|
Reference in New Issue
Block a user