From bc6b59859fe12c77500a5a05dd8b227077df1ca2 Mon Sep 17 00:00:00 2001
From: Hanno Becker <hanno.becker@arm.com>
Date: Tue, 2 Jul 2019 15:36:44 +0100
Subject: [PATCH] [Fixup] Add missing PK release call in Cert Verify parsing
mbedtls_ssl_read() can fail non-fatally, in which case
ssl_parse_certificate_verify() returned immediately without
calling mbedtls_x509_crt_pk_release(), which in turn lead
to a fatal error because of nested acquire calls in the
next call to the function.
---
library/ssl_srv.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 9e15f756a..40f8e0663 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -4274,7 +4274,7 @@ static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
if( 0 != ret )
{
MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_read_record" ), ret );
- return( ret );
+ goto exit;
}
ssl->state++;
@@ -4284,7 +4284,8 @@ static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
- return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
+ ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
+ goto exit;
}
i = mbedtls_ssl_hs_hdr_len( ssl );