From 24417f06feda5a0756c362146c932909c19b6673 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Mon, 28 Sep 2015 18:09:45 +0200 Subject: [PATCH] Fix potential double-free in mbedtls_ssl_conf_psk() --- ChangeLog | 7 +++++++ library/ssl_tls.c | 2 ++ 2 files changed, 9 insertions(+) diff --git a/ChangeLog b/ChangeLog index c9e48e244..f0c71fda4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,12 @@ mbed TLS ChangeLog (Sorted per branch, date) += mbed TLS 2.1.2 released 2015-??-?? + +Security + * Fix potential double-free if mbedtls_conf_psk() is called repeatedly on + the same mbedtls_ssl_config object and some memory allocations fail. + Found by Guido Vranken. Can not be forced remotely. + = mbed TLS 2.1.1 released 2015-09-17 Security diff --git a/library/ssl_tls.c b/library/ssl_tls.c index d9b05fd1f..c1e29c782 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -5707,7 +5707,9 @@ int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf, ( conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ) ) == NULL ) { mbedtls_free( conf->psk ); + mbedtls_free( conf->psk_identity ); conf->psk = NULL; + conf->psk_identity = NULL; return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); }