Merge of fix for IOTSSL-481 - Double free
Potential double free in mbedtls_ssl_conf_psk()
diff --git a/ChangeLog b/ChangeLog
index ca2e717..67da281 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -25,6 +25,9 @@
* Fix possible heap buffer overflow in base64_encoded() when the input
buffer is 512MB or larger on 32-bit platforms. Found by Guido Vranken,
Intelworks. Not trigerrable remotely in TLS.
+ * Fix potential double-free if mbedtls_conf_psk() is called repeatedly on
+ the same mbedtls_ssl_config object and memory allocation fails. Found by
+ Guido Vranken, Intelworks. Cannot be forced remotely.
Changes
* Added checking of hostname length in mbedtls_ssl_set_hostname() to ensure
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 43cbe0f..9142be8 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -5707,7 +5707,9 @@
( conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ) ) == NULL )
{
mbedtls_free( conf->psk );
+ mbedtls_free( conf->psk_identity );
conf->psk = NULL;
+ conf->psk_identity = NULL;
return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
}