commit 9cfc9ceaf9236b47874af8a275fd4eceb6f30c14
author Jaeden Amero <jaeden.amero@arm.com> Wed Apr 24 11:21:35 2019 +0100
committer Jaeden Amero <jaeden.amero@arm.com> Wed Apr 24 11:21:35 2019 +0100
tree abd350ace5243aeecd09a443254951dce871aaab
parent f57a9349ad71849a5ad540f941b2c368b3033bb6
parent 24eec79255f42c8a76c58da6c0862bad66158a56

Merge remote-tracking branch 'origin/pr/2542' into mbedtls-2.16

* origin/pr/2542:
  Add guards for MBEDTLS_X509_CRL_PARSE_C in sample

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 9e46fdc..798e84a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -36,6 +36,8 @@
      public macro MBEDTLS_X509_ID_FLAG. This could lead to invalid evaluation
      in case operators binding less strongly than subtraction were used
      for the parameter.
+   * Add a check for MBEDTLS_X509_CRL_PARSE_C in ssl_server2, guarding the crl
+     sni entry parameter. Reported by inestlerode in #560.
 
 Changes
    * Return from various debugging routines immediately if the

programs/ssl/ssl_server2.c

diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index ee48234..87430dc 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -251,8 +251,14 @@
 #endif /* MBEDTLS_SSL_CACHE_C */
 
 #if defined(SNI_OPTION)
+#if defined(MBEDTLS_X509_CRL_PARSE_C)
+#define SNI_CRL              ",crl"
+#else
+#define SNI_CRL              ""
+#endif
+
 #define USAGE_SNI                                                           \
-    "    sni=%%s              name1,cert1,key1,ca1,crl1,auth1[,...]\n"  \
+    "    sni=%%s              name1,cert1,key1,ca1"SNI_CRL",auth1[,...]\n"  \
     "                        default: disabled\n"
 #else
 #define USAGE_SNI ""
@@ -622,10 +628,10 @@
 
         mbedtls_x509_crt_free( cur->ca );
         mbedtls_free( cur->ca );
-
+#if defined(MBEDTLS_X509_CRL_PARSE_C)
         mbedtls_x509_crl_free( cur->crl );
         mbedtls_free( cur->crl );
-
+#endif
         next = cur->next;
         mbedtls_free( cur );
         cur = next;
@@ -644,7 +650,10 @@
     sni_entry *cur = NULL, *new = NULL;
     char *p = sni_string;
     char *end = p;
-    char *crt_file, *key_file, *ca_file, *crl_file, *auth_str;
+    char *crt_file, *key_file, *ca_file, *auth_str;
+#if defined(MBEDTLS_X509_CRL_PARSE_C)
+    char *crl_file;
+#endif
 
     while( *end != '\0' )
         ++end;
@@ -662,7 +671,9 @@
         GET_ITEM( crt_file );
         GET_ITEM( key_file );
         GET_ITEM( ca_file );
+#if defined(MBEDTLS_X509_CRL_PARSE_C)
         GET_ITEM( crl_file );
+#endif
         GET_ITEM( auth_str );
 
         if( ( new->cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) ) ) == NULL ||
@@ -687,6 +698,7 @@
                 goto error;
         }
 
+#if defined(MBEDTLS_X509_CRL_PARSE_C)
         if( strcmp( crl_file, "-" ) != 0 )
         {
             if( ( new->crl = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl ) ) ) == NULL )
@@ -697,6 +709,7 @@
             if( mbedtls_x509_crl_parse_file( new->crl, crl_file ) != 0 )
                 goto error;
         }
+#endif
 
         if( strcmp( auth_str, "-" ) != 0 )
         {