From 3cae167e6ac2b2d1aec5ca070c4cab62c6af994b Mon Sep 17 00:00:00 2001 From: Neil Armstrong Date: Tue, 5 Apr 2022 10:01:15 +0200 Subject: [PATCH] Check buffer pointers before storing peer's public key in ECHDE-PSK PSA version of ssl_parse_client_key_exchange() Signed-off-by: Neil Armstrong --- library/ssl_tls12_server.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c index bfd8fd3cac..d9a29dcd00 100644 --- a/library/ssl_tls12_server.c +++ b/library/ssl_tls12_server.c @@ -4057,8 +4057,15 @@ static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl ) } /* Keep a copy of the peer's public key */ + if( p >= end ) + { + psa_destroy_key( handshake->ecdh_psa_privkey ); + handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; + return( MBEDTLS_ERR_SSL_DECODE_ERROR ); + } + ecpoint_len = *(p++); - if( (size_t)( end - *p ) < ecpoint_len ) { + if( (size_t)( end - p ) < ecpoint_len ) { psa_destroy_key( handshake->ecdh_psa_privkey ); handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; return( MBEDTLS_ERR_SSL_DECODE_ERROR );