From 7864090ec1ac5ebcdb76db39f324a0faf8e4cf18 Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Mon, 13 Aug 2018 16:35:15 +0100 Subject: [PATCH 1/3] Reset session_in/out pointers in ssl_session_reset_int() Fixes #1941. --- library/ssl_tls.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 91f96c8ab6..3b047fc0bf 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -5973,6 +5973,9 @@ static int ssl_session_reset_int( mbedtls_ssl_context *ssl, int partial ) ssl->transform_in = NULL; ssl->transform_out = NULL; + ssl->session_in = NULL; + ssl->session_out = NULL; + memset( ssl->out_buf, 0, MBEDTLS_SSL_OUT_BUFFER_LEN ); if( partial == 0 ) memset( ssl->in_buf, 0, MBEDTLS_SSL_IN_BUFFER_LEN ); @@ -6842,14 +6845,14 @@ int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl ) size_t transform_expansion; const mbedtls_ssl_transform *transform = ssl->transform_out; + if( transform == NULL ) + return( (int) mbedtls_ssl_hdr_len( ssl ) ); + #if defined(MBEDTLS_ZLIB_SUPPORT) if( ssl->session_out->compression != MBEDTLS_SSL_COMPRESS_NULL ) return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); #endif - if( transform == NULL ) - return( (int) mbedtls_ssl_hdr_len( ssl ) ); - switch( mbedtls_cipher_get_cipher_mode( &transform->cipher_ctx_enc ) ) { case MBEDTLS_MODE_GCM: From 361f254eab6780f05ecb10ceb66022a2197d48a8 Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Mon, 13 Aug 2018 16:36:58 +0100 Subject: [PATCH 2/3] Adapt ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index abd5e61bbd..61a6552efa 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,6 +10,8 @@ Bugfix * Add ecc extensions only if an ecc based ciphersuite is used. This improves compliance to RFC 4492, and as a result, solves interoperability issues with BouncyCastle. Raised by milenamil in #1157. + * Fix potential segmentation fault in mbedtls_ssl_get_max_frag_len() + and mbedtls_ssl_get_record_expansion() after a session reset. Fixes #1941. Changes * Copy headers preserving timestamps when doing a "make install". From 9dc3be760131fbd4aa1637b9d961ce7a9178c12d Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Tue, 14 Aug 2018 15:22:05 +0100 Subject: [PATCH 3/3] Improve wording in ChangeLog --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 61a6552efa..59561fd072 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,7 +10,7 @@ Bugfix * Add ecc extensions only if an ecc based ciphersuite is used. This improves compliance to RFC 4492, and as a result, solves interoperability issues with BouncyCastle. Raised by milenamil in #1157. - * Fix potential segmentation fault in mbedtls_ssl_get_max_frag_len() + * Fix potential use-after-free in mbedtls_ssl_get_max_frag_len() and mbedtls_ssl_get_record_expansion() after a session reset. Fixes #1941. Changes