yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-29 09:04:22 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix incrementing pointer instead of value

Browse Source 
This was introduced by a hasty search-and-replace that didn't account for C's
operator precedence when changing those variables to pointer types.
This commit is contained in:
Manuel Pégourié-Gonnard 2020-01-24 12:11:56 +01:00 committed by Simon Butcher
parent c0213a91ab
commit aa377cf111
2 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ChangeLog
View File

@ -63,7 +63,15 @@ Changes
* Reduce RAM consumption during session renegotiation by not storing * Reduce RAM consumption during session renegotiation by not storing
the peer CRT chain and session ticket twice. the peer CRT chain and session ticket twice.
= mbed TLS 2.16.x branch released xxxx-xx-xx = mbed TLS 2.16.5 branch released xxxx-xx-xx
Security
* Fix potential memory overread when performing an ECDSA signature
operation. The overread only happens with cryptographically low
probability (of the order of 2^-n where n is the bitsize of the curve)
unless the RNG is broken, and could result in information disclosure or
denial of service (application crash or extra resource consumption).
Reported by Peter and Auke (found using static analysis).
Bugfix Bugfix
* Fix an unchecked call to mbedtls_md() in the x509write module. * Fix an unchecked call to mbedtls_md() in the x509write module.

4
library/ecdsa.c
View File

@ -297,7 +297,7 @@ static int ecdsa_sign_restartable( mbedtls_ecp_group *grp,
*p_sign_tries = 0; *p_sign_tries = 0;
do do
{ {
if( *p_sign_tries++ > 10 ) if( (*p_sign_tries)++ > 10 )
{ {
ret = MBEDTLS_ERR_ECP_RANDOM_FAILED; ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
goto cleanup; goto cleanup;
@ -310,7 +310,7 @@ static int ecdsa_sign_restartable( mbedtls_ecp_group *grp,
*p_key_tries = 0; *p_key_tries = 0;
do do
{ {
if( *p_key_tries++ > 10 ) if( (*p_key_tries)++ > 10 )
{ {
ret = MBEDTLS_ERR_ECP_RANDOM_FAILED; ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
goto cleanup; goto cleanup;