h2o / picotls

TLS 1.3 implementation in C (master supports RFC8446 as well as draft-26, -27, -28)
527 stars 140 forks source link

no error handling of key_schedule_new failure #488

Open sshock opened 9 months ago

sshock commented 9 months ago

key_schedule_new is called from two places, but neither one checks for NULL return value.

As a result, failure to create a hash alg results in a crash (seg fault) happening later on in an unrelated spot.

Can we add something like this after calling key_schedule_new in these two spots?

        if (tls->key_schedule == NULL) {
            ret = PTLS_ERROR_NO_MEMORY;
            goto Exit;
        }