commit 4e03439e6a915bdafcd2adc6596f98a2e834f315
author Janos Follath <janos.follath@arm.com> Thu Apr 21 23:37:09 2016 +0100
committer Simon Butcher <simon.butcher@arm.com> Fri Apr 22 09:59:00 2016 +0100
tree 86a87af255e8491204e90bb3d07f68f15ea541cb
parent 7ddc2cdfce7322f73b97375ba67b6de7c0cb55ae

Fix bug in ssl_write_supported_elliptic_curves_ext

Passing invalid curves to mbedtls_ssl_conf_curves potentially could caused a
crash later in ssl_write_supported_elliptic_curves_ext. #373

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 9a3b8a7..9e8dc46 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -10,6 +10,8 @@
    * Fix issue that caused a hang up when generating RSA keys of odd bitlength
    * Fix bug in mbedtls_rsa_rsaes_pkcs1_v15_encrypt that made null pointer
      dereference possible.
+   * Fix issue that caused a crash if invalid curves were passed to
+     mbedtls_ssl_conf_curves. #373
 
 Changes
    * On ARM platforms, when compiling with -O0 with GCC, Clang or armcc5,

library/ssl_cli.c

diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index b1cd7cb..fbbbf81 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -330,6 +330,12 @@
     for( info = ecp_curve_list(); info->grp_id != POLARSSL_ECP_DP_NONE; info++ )
     {
 #endif
+        if( info == NULL )
+        {
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid curve in ssl configuration" ) );
+            return;
+        }
+
         elliptic_curve_len += 2;
     }
 
@@ -349,7 +355,6 @@
     for( info = ecp_curve_list(); info->grp_id != POLARSSL_ECP_DP_NONE; info++ )
     {
 #endif
-
         elliptic_curve_list[elliptic_curve_len++] = info->tls_id >> 8;
         elliptic_curve_list[elliptic_curve_len++] = info->tls_id & 0xFF;
     }