Don't forget about pending alerts after ssl_get_next_record()
ssl_get_next_record() may pend fatal alerts in response to receiving
invalid records. Previously, however, those were never actually sent
because there was no code-path checking for pending alerts.
This commit adds a call to ssl_send_pending_fatal_alert() after
the invocation of ssl_get_next_record() to fix this.
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 601f81f..0b86e36 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -5116,6 +5116,7 @@
if( ret != 0 )
{
MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_get_next_record" ), ret );
+ ssl_send_pending_fatal_alert( ssl );
return( ret );
}
}