commit 86e48c213c89df42040aa8e2e7d9a951b5e52a79
author Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> Tue May 07 10:17:56 2019 +0200
committer Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> Tue May 07 10:32:19 2019 +0200
tree 994fec7165b840679f30ea658a168155bcd4d723
parent 1d10a98f56c7d5e1450d60588e3c6e6e6eb3d459

Enforce promise to not use whole ssl context

Configs with no DEBUG_C are use for example in test-ref-configs.pl, which also
runs parts of compat.sh or ssl-opt.sh on them, so the added 'ssl = NULL'
statements will be exercised in those tests at least.

library/ssl_tls.c

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index cb92676..0f416b1 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -654,6 +654,7 @@
 #if !defined(MBEDTLS_SSL_HW_RECORD_ACCEL) && \
     !defined(MBEDTLS_SSL_EXPORT_KEYS) && \
     !defined(MBEDTLS_DEBUG_C)
+    ssl = NULL; /* make sure we don't use it except for those cases */
     (void) ssl;
 #endif
 
@@ -1108,6 +1109,7 @@
     int ret;
 
 #if !defined(MBEDTLS_DEBUG_C) && !defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
+    ssl = NULL; /* make sure we don't use it except for debug and EMS */
     (void) ssl;
 #endif
 
@@ -1589,6 +1591,7 @@
 
     /* The SSL context is only used for debugging purposes! */
 #if !defined(MBEDTLS_DEBUG_C)
+    ssl = NULL; /* make sure we don't use it except for debug */
     ((void) ssl);
 #endif
 
@@ -1982,6 +1985,7 @@
     unsigned char add_data[13];
 
 #if !defined(MBEDTLS_DEBUG_C)
+    ssl = NULL; /* make sure we don't use it except for debug */
     ((void) ssl);
 #endif