From ccfd3bcf5d4bcaf1ca0cf9ffe74b9eaf7b8a1b2a Mon Sep 17 00:00:00 2001 From: Jon Shallow Date: Wed, 29 Apr 2020 09:49:28 +0100 Subject: [PATCH 1/2] DTLS: Fix identity length checking src/coap_tinydtls.c: Pass the correct identity size to coap_get_session_client_psk() --- src/coap_tinydtls.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/src/coap_tinydtls.c b/src/coap_tinydtls.c index bc82b9e7..b56385dd 100644 --- a/src/coap_tinydtls.c +++ b/src/coap_tinydtls.c @@ -229,9 +229,10 @@ get_psk_info(struct dtls_context_t *dtls_context, } identity_length = 0; + /* result_length is max size of the returned identity */ psk_len = coap_context->get_client_psk(coap_session, (const uint8_t*)id, id_len, (uint8_t*)result, &identity_length, result_length, psk, sizeof(psk)); if (!psk_len) { - coap_log(LOG_WARNING, "no PSK identity for given realm\n"); + coap_log(LOG_WARNING, "no PSK identity for given realm or buffer too small\n"); fatal_error = DTLS_ALERT_CLOSE_NOTIFY; goto error; } @@ -242,17 +243,13 @@ get_psk_info(struct dtls_context_t *dtls_context, if (!coap_context || !coap_context->get_client_psk) goto error; identity_length = 0; - psk_len = coap_context->get_client_psk(coap_session, (const uint8_t*)id, id_len, (uint8_t*)result, &identity_length, result_length, psk, sizeof(psk)); + /* Use psk[] as a scratch area for returning the unused identity */ + psk_len = coap_context->get_client_psk(coap_session, (const uint8_t*)id, id_len, psk, &identity_length, sizeof(psk), result, result_length); if (!psk_len) { - coap_log(LOG_WARNING, "no pre-shared key for given realm\n"); + coap_log(LOG_WARNING, "no pre-shared key for given realm or buffer too small\n"); fatal_error = DTLS_ALERT_CLOSE_NOTIFY; goto error; } - if (psk_len > result_length) { - coap_log(LOG_WARNING, "cannot set psk -- buffer too small\n"); - goto error; - } - memcpy(result, psk, psk_len); return (int)psk_len; } if (coap_context->get_server_psk) { From a40adc80c64d9693070ab82616b5278d2077e993 Mon Sep 17 00:00:00 2001 From: Olaf Bergmann Date: Tue, 16 Jun 2020 10:05:23 +0200 Subject: [PATCH 2/2] net.c: fix possible derefence after null check Fix possible null pointer dereference in coap_get_context_server_psk(). This issue has been detected by Coverity scan as CID 1495725. --- src/net.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/net.c b/src/net.c index acfc93d4..d883462f 100644 --- a/src/net.c +++ b/src/net.c @@ -330,7 +330,10 @@ coap_get_context_server_psk( (void)identity; (void)identity_len; - if (session && session->psk_key && + if (!session) + return 0; + + if (session->psk_key && session->psk_key->length <= max_psk_len) { memcpy(psk, session->psk_key->s, session->psk_key->length); return session->psk_key->length;