From 459e43a48c3663aae82b91bf17e0433f050875c8 Mon Sep 17 00:00:00 2001 From: Olaf Bergmann Date: Thu, 14 Feb 2019 18:51:19 +0100 Subject: [PATCH] coap_openssl.c: bugfix for empty PSK list In tls_client_hello_call_back(): When SSL_client_hello_get0_ciphers() returns 0, the result parameter out is not set. SSL_bytes_to_cipher_list() therefore is called only if len > 0. This function's results parameters peer_ciphers and scsvc also are accessed only if SSL_bytes_to_cipher_list() has returned 1. To avoid freeing invalid pointers by sk_SSL_CIPHER_free(), peer_ciphers and scsvc have been initialized with NULL. --- src/coap_openssl.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/src/coap_openssl.c b/src/coap_openssl.c index 9f621556..8a27c747 100644 --- a/src/coap_openssl.c +++ b/src/coap_openssl.c @@ -1323,19 +1323,20 @@ tls_client_hello_call_back(SSL *ssl, */ if (session && session->context->psk_key && session->context->psk_key_len) { int len = SSL_client_hello_get0_ciphers(ssl, &out); - STACK_OF(SSL_CIPHER) *peer_ciphers; - STACK_OF(SSL_CIPHER) *scsvc; - int ii; + STACK_OF(SSL_CIPHER) *peer_ciphers = NULL; + STACK_OF(SSL_CIPHER) *scsvc = NULL; - len = SSL_bytes_to_cipher_list(ssl, out, len, - SSL_client_hello_isv2(ssl), - &peer_ciphers, &scsvc); - for (ii = 0; ii < sk_SSL_CIPHER_num (peer_ciphers); ii++) { - const SSL_CIPHER *peer_cipher = sk_SSL_CIPHER_value(peer_ciphers, ii); + if (len && SSL_bytes_to_cipher_list(ssl, out, len, + SSL_client_hello_isv2(ssl), + &peer_ciphers, &scsvc)) { + int ii; + for (ii = 0; ii < sk_SSL_CIPHER_num (peer_ciphers); ii++) { + const SSL_CIPHER *peer_cipher = sk_SSL_CIPHER_value(peer_ciphers, ii); - if (strstr (SSL_CIPHER_get_name (peer_cipher), "PSK")) { - psk_requested = 1; - break; + if (strstr (SSL_CIPHER_get_name (peer_cipher), "PSK")) { + psk_requested = 1; + break; + } } } sk_SSL_CIPHER_free(peer_ciphers);