obgm/libcoap
2
0 Fork 0
mirror of https://github.com/obgm/libcoap.git synced 2026-11-07 18:12:55 +03:00
Code Issues Packages Projects Releases Wiki Activity

coap_openssl.c: bugfix for empty PSK list

Browse Source 
In tls_client_hello_call_back():

When SSL_client_hello_get0_ciphers() returns 0, the result parameter
out is not set. SSL_bytes_to_cipher_list() therefore is called only
if len > 0. This function's results parameters peer_ciphers and
scsvc also are accessed only if SSL_bytes_to_cipher_list() has
returned 1.

To avoid freeing invalid pointers by sk_SSL_CIPHER_free(), peer_ciphers
and scsvc have been initialized with NULL.
This commit is contained in:
Olaf Bergmann committed 2019-02-14 18:51:19 +01:00
1 parent 8dbc02d525
commit 459e43a48c
1 file changed
+12 -11
Download Patch File Download Diff File Expand all files Collapse all files
src/coap_openssl.c
+12 -11
View File
@@ -1323,19 +1323,20 @@ tls_client_hello_call_back(SSL *ssl,
*/
if (session && session->context->psk_key && session->context->psk_key_len) {
int len = SSL_client_hello_get0_ciphers(ssl, &out);
STACK_OF(SSL_CIPHER) *peer_ciphers;
STACK_OF(SSL_CIPHER) *scsvc;
int ii;
STACK_OF(SSL_CIPHER) *peer_ciphers = NULL;
STACK_OF(SSL_CIPHER) *scsvc = NULL;
len = SSL_bytes_to_cipher_list(ssl, out, len,
SSL_client_hello_isv2(ssl),
&peer_ciphers, &scsvc);
for (ii = 0; ii < sk_SSL_CIPHER_num (peer_ciphers); ii++) {
const SSL_CIPHER *peer_cipher = sk_SSL_CIPHER_value(peer_ciphers, ii);
if (len && SSL_bytes_to_cipher_list(ssl, out, len,
SSL_client_hello_isv2(ssl),
&peer_ciphers, &scsvc)) {
int ii;
for (ii = 0; ii < sk_SSL_CIPHER_num (peer_ciphers); ii++) {
const SSL_CIPHER *peer_cipher = sk_SSL_CIPHER_value(peer_ciphers, ii);
if (strstr (SSL_CIPHER_get_name (peer_cipher), "PSK")) {
psk_requested = 1;
break;
if (strstr (SSL_CIPHER_get_name (peer_cipher), "PSK")) {
psk_requested = 1;
break;
}
}
}
sk_SSL_CIPHER_free(peer_ciphers);