yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-23 13:25:43 +01:00
Code Issues Packages Projects Releases Wiki Activity
5709811dd2
mbedtls/library
History
Manuel Pégourié-Gonnard 5709811dd2 Add test for session_load() from small buffers 
This uncovered a bug that led to a double-free (in practice, in general could
be free() on any invalid value): initially the session structure is loaded
with `memcpy()` which copies the previous values of pointers peer_cert and
ticket to heap-allocated buffers (or any other value if the input is
attacker-controlled). Now if we exit before we got a chance to replace those
invalid values with valid ones (for example because the input buffer is too
small, or because the second malloc() failed), then the next call to
session_free() is going to call free() on invalid pointers.

This bug is fixed in this commit by always setting the pointers to NULL right
after they've been read from the serialised state, so that the invalid values
can never be used.

(An alternative would be to NULL-ify them when writing, which was rejected
mostly because we need to do it when reading anyway (as the consequences of
free(invalid) are too severe to take any risk), so doing it when writing as
well is redundant and a waste of code size.)

Also, while thinking about what happens in case of errors, it became apparent
to me that it was bad practice to leave the session structure in an
half-initialised state and rely on the caller to call session_free(), so this
commit also ensures we always clear the structure when loading failed.
2019-06-03 09:51:08 +02:00
..
.gitignore
aes.c Add further missing brackets around macro parameters 2019-04-24 10:52:45 +02:00
aesni.c Warn if using a memory sanitizer on AESNI 2018-04-05 15:37:38 +02:00
arc4.c Rename mbedtls_zeroize to mbedtls_platform_zeroize 2018-04-17 10:00:21 -05:00
aria.c Implement parameter validation for ARIA module 2018-12-19 12:51:00 +00:00
asn1parse.c Rename mbedtls_zeroize to mbedtls_platform_zeroize 2018-04-17 10:00:21 -05:00
asn1write.c Fix ASN1 bitstring writing 2019-02-11 21:13:33 +00:00
base64.c
bignum.c Fix typo 2019-03-06 13:51:30 +00:00
blowfish.c Implement parameter validation for Blowfish module 2018-12-19 12:52:59 +00:00
camellia.c Minor improvements to Camellia module and documentation 2018-12-19 13:42:05 +00:00
ccm.c Improve macro hygiene 2019-04-24 10:51:54 +02:00
certs.c Use certificates from data_files and refer them 2019-02-12 17:10:29 +02:00
chacha20.c Improve macro hygiene 2019-04-24 10:51:54 +02:00
chachapoly.c Fix wrong conditional in free() functions 2018-12-18 15:30:30 +00:00
cipher_wrap.c Fix after PR comments 2018-07-23 18:18:32 +01:00
cipher.c Remove unnecessary parameter validation from the Cipher module 2018-12-19 17:34:58 +01:00
cmac.c Merge remote-tracking branch 'public/pr/1390' into development 2018-06-27 10:51:47 +01:00
CMakeLists.txt Merge remote-tracking branch 'origin/pr/566' into baremetal 2019-05-09 16:59:02 +01:00
ctr_drbg.c Streamline mbedtls_xxx_drbg_update_seed_file 2018-11-26 19:26:22 +01:00
debug.c Merge remote-tracking branch 'origin/pr/1818' into mbedtls-2.16 2019-03-05 16:28:18 +00:00
des.c Improve macro hygiene 2019-04-24 10:51:54 +02:00
dhm.c Merge remote-tracking branch 'public/pr/1721' into development-restricted 2018-12-20 12:37:13 +00:00
ecdh.c Fix mbedtls_ecdh_get_params with new ECDH context 2019-02-22 12:51:51 +01:00
ecdsa.c Return error code of underlying function. 2019-01-10 10:52:08 +02:00
ecjpake.c Minor fixes to ECJPAKE parameter validation 2018-12-19 09:48:50 +00:00
ecp_curves.c Improve macro hygiene 2019-04-24 10:51:54 +02:00
ecp.c Improve macro hygiene 2019-04-24 10:51:54 +02:00
entropy_poll.c Add missing bracket 2018-11-06 13:12:47 +00:00
entropy.c Rename mbedtls_zeroize to mbedtls_platform_zeroize 2018-04-17 10:00:21 -05:00
error.c Add specific SSL error code for unexpected CIDs 2019-05-20 15:32:36 +01:00
gcm.c Improve parameter validation in mbedtls_gcm_free() 2018-12-19 17:32:19 +01:00
havege.c Improve macro hygiene 2019-04-24 10:51:54 +02:00
hkdf.c Fix issue if salt = NULL and salt_len !=0 in mbedtls_hkdf_extract() 2018-07-23 10:34:47 -07:00
hmac_drbg.c Streamline mbedtls_xxx_drbg_update_seed_file 2018-11-26 19:26:22 +01:00
Makefile Tinycrypt support for makefile builds 2019-04-25 11:00:41 +03:00
md2.c Rename mbedtls_zeroize to mbedtls_platform_zeroize 2018-04-17 10:00:21 -05:00
md4.c Add more missing parentheses around macro parameters 2019-04-24 10:52:53 +02:00
md5.c Add further missing brackets around macro parameters 2019-04-24 10:52:45 +02:00
md_wrap.c
md.c Rename mbedtls_zeroize to mbedtls_platform_zeroize 2018-04-17 10:00:21 -05:00
memory_buffer_alloc.c Fix braces in mbedtls_memory_buffer_alloc_status() 2018-06-12 16:56:04 +01:00
net_sockets.c Merge remote-tracking branch 'public/pr/1198' into development 2018-07-24 17:20:17 +01:00
nist_kw.c Remove faulty cipher_finish calls from nist_kw 2018-12-20 12:15:40 +01:00
oid.c Improve macro hygiene 2019-04-24 10:51:54 +02:00
padlock.c
pem.c Clear pk context and other minor changes in *_free() procedures 2018-06-12 18:25:09 +03:00
pk_wrap.c Fix or improve some comments (and whitespace) 2018-10-15 15:27:49 +02:00
pk.c Merge remote-tracking branch 'public/pr/1721' into development-restricted 2018-12-20 12:37:13 +00:00
pkcs5.c Guard mbedtls_pkcs5_pbes2() by MBEDTLS_ASN1_PARSE_C 2018-10-16 13:39:40 +01:00
pkcs11.c
pkcs12.c Make PBE-related parts of PKCS12 depend on MBEDTLS_ASN1_PARSE_C 2018-10-16 13:39:40 +01:00
pkparse.c pk_parse*keyfile: explicitly validate path=NULL 2018-12-19 17:37:02 +01:00
pkwrite.c PK parse/write: support keylen=0 correctly 2018-12-19 17:03:28 +01:00
platform_util.c Remove the library provided function of MBEDTLS_PARAM_FAILED 2018-12-11 12:28:56 +01:00
platform.c Omit runtime configuration of calloc/free if macro config enabled 2018-10-11 11:04:20 +01:00
poly1305.c Improve macro hygiene 2019-04-24 10:51:54 +02:00
ripemd160.c Improve macro hygiene 2019-04-24 10:51:54 +02:00
rsa_internal.c Bignum: Deprecate mbedtls_mpi_is_prime() 2018-10-09 16:36:53 +01:00
rsa.c Merge remote-tracking branch 'public/pr/1721' into development-restricted 2018-12-20 12:37:13 +00:00
sha1.c Add further missing brackets around macro parameters 2019-04-24 10:52:45 +02:00
sha256.c Add further missing brackets around macro parameters 2019-04-24 10:52:45 +02:00
sha512.c Add more missing parentheses around macro parameters 2019-04-24 10:52:53 +02:00
ssl_cache.c
ssl_ciphersuites.c Reduce priority of 3DES ciphersuites 2019-03-01 10:29:13 +01:00
ssl_cli.c Merge remote-tracking branch 'origin/pr/561' into baremetal 2019-05-29 15:09:24 +01:00
ssl_cookie.c Rename mbedtls_zeroize to mbedtls_platform_zeroize 2018-04-17 10:00:21 -05:00
ssl_srv.c Merge remote-tracking branch 'origin/pr/561' into baremetal 2019-05-29 15:09:24 +01:00
ssl_ticket.c Move session save/load function to ssl_tls.c 2019-06-03 09:51:08 +02:00
ssl_tls.c Add test for session_load() from small buffers 2019-06-03 09:51:08 +02:00
threading.c Don't declare and define gmtime()-mutex on Windows platforms 2018-09-06 12:09:56 +01:00
timing.c Merge remote-tracking branch 'public/pr/1777' into development-proposed 2018-11-04 18:51:36 +00:00
version_features.c Merge remote-tracking branch 'origin/pr/561' into baremetal 2019-05-29 15:09:24 +01:00
version.c
x509_create.c Break overly long line in library/x509_create.c 2018-11-02 10:52:38 +00:00
x509_crl.c Rename mbedtls_zeroize to mbedtls_platform_zeroize 2018-04-17 10:00:21 -05:00
x509_crt.c Improve macro hygiene 2019-04-24 10:51:54 +02:00
x509_csr.c Fix CSR parsing header call 2018-10-07 17:48:37 +01:00
x509.c Improve macro hygiene 2019-04-24 10:51:54 +02:00
x509write_crt.c Fix ASN1 bitstring writing 2019-02-11 21:13:33 +00:00
x509write_csr.c Fix ASN1 bitstring writing 2019-02-11 21:13:33 +00:00
xtea.c Rename mbedtls_zeroize to mbedtls_platform_zeroize 2018-04-17 10:00:21 -05:00