Mbed-TLS / mbedtls

An open source, portable, easy to use, readable and flexible TLS library, and reference implementation of the PSA Cryptography API. Releases are on a varying cadence, typically around 3 - 6 months between releases.
https://www.trustedfirmware.org/projects/mbed-tls/
Other
5.03k stars 2.51k forks source link

Set psk to NULL in ssl_psk_remove #9241

Closed lhuang04 closed 2 weeks ago

lhuang04 commented 2 weeks ago

Summary: set the psk to NULL after it is released. ssl_remove_psk will freessl->handshake->psk. If we don't set it to NULL. It may be used or free again in other conditions.

Test Plan:

Reviewers:

Subscribers: ronald.cron@arm.com

Tasks:

Tags:

Description

Address an issue that psk is not set to NULL after it is released.

PR checklist

Please tick as appropriate and edit the reasons (e.g.: "backport: not needed because this is a new feature")

Notes for the submitter

Please refer to the contributing guidelines, especially the checklist for PR contributors.

Help make review efficient:

tom-cosgrove-arm commented 2 weeks ago

Could you please raise backports against the mbedtls-2.28 and mbedtls-3.6 branches as well, please?

lhuang04 commented 2 weeks ago

Backport PR 9245 for 3.6 branch, and PR 9246 for 2.8 branch.