AuroraMiddleware/mbedtls
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Don't call memcpy() with 0-length arguments

Browse Source 
The standard prohibits calling memcpy() with NULL pointer
arguments, even if the size argument is 0.

The TLS-1.2 PRF generator setup function previously called
memcpy() with the label and salt as the source, even if
they were of length 0, as exercised by the derive_key_policy
test case in the PSA crypto test suite.

This commit adds guards around the memcpy() calls so that they
are only executed of salt or label have positive length, respectively.
This commit is contained in:
Hanno Becker 2018-11-15 09:53:57 +00:00
parent 3b339e2342
commit 353e45361d
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
library/psa_crypto.c
View File

@ -3708,9 +3708,17 @@ static psa_status_t psa_generator_tls12_prf_setup(
/* Write `label + seed' at the end of the `A(i) + seed` buffer,
* leaving the initial `hash_length` bytes unspecified for now. */
memcpy( tls12_prf->Ai_with_seed + hash_length, label, label_length );
memcpy( tls12_prf->Ai_with_seed + hash_length + label_length,
salt, salt_length );
if( label_length != 0 )
{
memcpy( tls12_prf->Ai_with_seed + hash_length,
label, label_length );
}
if( salt_length != 0 )
{
memcpy( tls12_prf->Ai_with_seed + hash_length + label_length,
salt, salt_length );
}
/* The first block gets generated when
* psa_generator_read() is called. */