yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-02-01 12:21:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix memory leak in ecp_mul_comb() if ecp_precompute_comb() fails

Browse source 
In ecp_mul_comb(), if (!p_eq_g && grp->T == NULL) and then ecp_precompute_comb() fails (which can
happen due to OOM), then the new array of points T will be leaked (as it's newly allocated, but
hasn't been asigned to grp->T yet).

Symptom was a memory leak in ECDHE key exchange under low memory conditions.
This commit is contained in:
Angus Gratton 2017-09-06 15:07:17 +10:00 committed by Ron Eldor
parent 63cc716575
commit ba25ffef87
2 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
ChangeLog
View file

@ -35,6 +35,8 @@ Bugfix
* Correct the documentation for `mbedtls_ssl_get_session()`. * Correct the documentation for `mbedtls_ssl_get_session()`.
This API has deep copy of the session, and the peer This API has deep copy of the session, and the peer
certificate is not lost. Fixes #926. certificate is not lost. Fixes #926.
* Fix a memory leak in ecp_mul_comb() if ecp_precompute_comb() fails.
Fix contributed by Espressif Systems.
Changes Changes
* Change the shebang line in Perl scripts to look up perl in the PATH. * Change the shebang line in Perl scripts to look up perl in the PATH.

7
library/ecp.c
View file

@ -1390,7 +1390,12 @@ static int ecp_mul_comb( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
cleanup: cleanup:
if( T != NULL && ! p_eq_g ) /* There are two cases where T is not stored in grp:
* - P != G
* - An intermediate operation failed before setting grp->T
* In either case, T must be freed.
*/
if( T != NULL && T != grp->T )
{ {
for( i = 0; i < pre_len; i++ ) for( i = 0; i < pre_len; i++ )
mbedtls_ecp_point_free( &T[i] ); mbedtls_ecp_point_free( &T[i] );