Missing check on input arguments (NULL dereference) #2038

ManSoSec · 2019-01-17T16:21:29Z

I noticed this missing argument check here (in HashOutput)
https://github.com/wolfSSL/wolfssl/blob/master/src/internal.c#L6477

While it is done in 2 functions (HashInput and HashOutputRaw) here:
https://github.com/wolfSSL/wolfssl/blob/master/src/internal.c#L6431
https://github.com/wolfSSL/wolfssl/blob/master/src/internal.c#L6550

if (ssl->hsHashes == NULL)
return BAD_FUNC_ARG;

I can send a pull request.

ejohnstown · 2019-01-17T17:35:37Z

Thank you for bringing this to our attention. I'll go ahead and fix this and the other two issues.

1. In the client, check the return code on wolfSSL_CTX_SetMinDhKey_Sz() as it is checked in the server. (Resolves issue wolfSSL#2037.) 2. In HashOutput(), check that the hsHashes exists for the session before hashing. (Resolves issue wolfSSL#2038.)

dgarske assigned ejohnstown Jan 17, 2019

ejohnstown mentioned this issue Jan 17, 2019

Fix Checks #2040

Merged

ejohnstown closed this as completed Jan 19, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Missing check on input arguments (NULL dereference) #2038

Missing check on input arguments (NULL dereference) #2038

ManSoSec commented Jan 17, 2019 •

edited

ejohnstown commented Jan 17, 2019

Missing check on input arguments (NULL dereference) #2038

Missing check on input arguments (NULL dereference) #2038

Comments

ManSoSec commented Jan 17, 2019 • edited

ejohnstown commented Jan 17, 2019

ManSoSec commented Jan 17, 2019 •

edited