commit 0761733c1b098e4f2d2fc815181dc916bb6cb0b7
author Manuel Pégourié-Gonnard <mpg@elzevir.fr> Wed Jun 24 23:00:03 2015 +0200
committer Manuel Pégourié-Gonnard <mpg@elzevir.fr> Thu Jun 25 10:59:57 2015 +0200
tree 1d90c04214e9acb649d01271eeb3ddef46fc575e
parent dba460f2f358b9fb0b00157e20ecd9958106870f

Fix potential NULL dereference

We document that either of recv or recv_timeout may be NULL, but for TLS we
always used recv... Thanks Coverity for catching that.
(Not remotely trigerrable: local configuration.)

Also made me notice net_recv_timeout didn't do its job properly.

library/ssl_tls.c

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 222536d..529cbeb 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -2293,7 +2293,7 @@
 
             MBEDTLS_SSL_DEBUG_MSG( 3, ( "f_recv_timeout: %u ms", timeout ) );
 
-            if( ssl->f_recv_timeout != NULL && timeout != 0 )
+            if( ssl->f_recv_timeout != NULL )
                 ret = ssl->f_recv_timeout( ssl->p_bio, ssl->in_hdr, len,
                                                                     timeout );
             else
@@ -2359,11 +2359,23 @@
             if( ssl_check_timer( ssl ) != 0 )
                 ret = MBEDTLS_ERR_SSL_TIMEOUT;
             else
-                ret = ssl->f_recv( ssl->p_bio, ssl->in_hdr + ssl->in_left, len );
+            {
+                if( ssl->f_recv_timeout != NULL )
+                {
+                    ret = ssl->f_recv_timeout( ssl->p_bio,
+                                               ssl->in_hdr + ssl->in_left, len,
+                                               ssl->conf->read_timeout );
+                }
+                else
+                {
+                    ret = ssl->f_recv( ssl->p_bio,
+                                       ssl->in_hdr + ssl->in_left, len );
+                }
+            }
 
             MBEDTLS_SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
-                           ssl->in_left, nb_want ) );
-            MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv", ret );
+                                        ssl->in_left, nb_want ) );
+            MBEDTLS_SSL_DEBUG_RET( 2, "ssl->f_recv(_timeout)", ret );
 
             if( ret == 0 )
                 return( MBEDTLS_ERR_SSL_CONN_EOF );