From c234ecf6956399405fe66d3c392c402b2cadcb0b Mon Sep 17 00:00:00 2001
From: Xiaofei Bai <xiaofei.bai@arm.com>
Date: Tue, 8 Feb 2022 09:59:23 +0000
Subject: [PATCH] Update mbedtls_ssl_handshake_free() and address review
 comments.

Signed-off-by: Xiaofei Bai <xiaofei.bai@arm.com>
---
 library/ssl_tls.c           |  7 ++++++-
 library/ssl_tls13_client.c  | 14 ++++++--------
 library/ssl_tls13_generic.c |  3 +--
 3 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 5e8b60b9bc..d08fe3a0a8 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -5579,7 +5579,12 @@ void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
         mbedtls_free( (void*) handshake->sig_algs );
     handshake->sig_algs = NULL;
 #endif /* MBEDTLS_DEPRECATED_REMOVED */
-
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+    if( ssl->handshake->certificate_request_context )
+    {
+        mbedtls_free( (void*) handshake->certificate_request_context );
+    }
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
 
 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c
index 62ed098351..a103c9da0e 100644
--- a/library/ssl_tls13_client.c
+++ b/library/ssl_tls13_client.c
@@ -1468,6 +1468,7 @@ static int ssl_tls13_parse_certificate_request( mbedtls_ssl_context *ssl,
 
     if( certificate_request_context_len > 0 )
     {
+        MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, certificate_request_context_len );
         MBEDTLS_SSL_DEBUG_BUF( 3, "Certificate Request Context",
                                p, certificate_request_context_len );
 
@@ -1479,7 +1480,6 @@ static int ssl_tls13_parse_certificate_request( mbedtls_ssl_context *ssl,
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
             return ( MBEDTLS_ERR_SSL_ALLOC_FAILED );
         }
-        MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, certificate_request_context_len );
         memcpy( handshake->certificate_request_context, p,
                 certificate_request_context_len );
         p += certificate_request_context_len;
@@ -1523,7 +1523,7 @@ static int ssl_tls13_parse_certificate_request( mbedtls_ssl_context *ssl,
                 {
                     MBEDTLS_SSL_DEBUG_MSG( 3,
                         ( "Duplicate signature algorithms extensions found" ) );
-                    goto error;
+                    goto decode_error;
                 }
                 break;
 
@@ -1540,23 +1540,21 @@ static int ssl_tls13_parse_certificate_request( mbedtls_ssl_context *ssl,
     if( p != end )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1,
-            ( "CertificateRequset misaligned" ) );
-        goto error;
+            ( "CertificateRequest misaligned" ) );
+        goto decode_error;
     }
     /* Check that we found signature algorithms extension */
     if( ! sig_alg_ext_found )
     {
         MBEDTLS_SSL_DEBUG_MSG( 3,
             ( "no signature algorithms extension found" ) );
-        MBEDTLS_SSL_DEBUG_MSG( 1,
-            ( "ssl_tls13_parse_certificate_request" ) );
-        goto error;
+        goto decode_error;
     }
 
     ssl->client_auth = 1;
     return( 0 );
 
-error:
+decode_error:
     MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
                                   MBEDTLS_ERR_SSL_DECODE_ERROR );
     return( MBEDTLS_ERR_SSL_DECODE_ERROR );
diff --git a/library/ssl_tls13_generic.c b/library/ssl_tls13_generic.c
index e174d63984..c8c2583ee9 100644
--- a/library/ssl_tls13_generic.c
+++ b/library/ssl_tls13_generic.c
@@ -158,9 +158,8 @@ int mbedtls_ssl_tls13_parse_sig_alg_ext( mbedtls_ssl_context *ssl,
     size_t supported_sig_algs_len = 0;
     const unsigned char *supported_sig_algs_end;
     uint16_t sig_alg;
-    uint32_t common_idx = 0; /* iterate through received signature schemes list */
+    uint32_t common_idx = 0;
 
-    /* skip 2 bytes of signature algorithms length */
     MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
     supported_sig_algs_len = MBEDTLS_GET_UINT16_BE( p, 0 );
     p += 2;