coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix possible duplication or deduplication of ssl_hostname_skip_cn_verification

Browse Source 
Fix mbedtls_ssl_set_hostname(ssl, NULL) causing the connection to
fail when compiled with some versions of IAR in configurations
with MBEDTLS_SSL_SERVER_NAME_INDICATION disabled. Also fix
mbedtls_ssl_set_hostname(ssl, "") which could disable hostname
verification instead of requiring an empty hostname when compiled
with some optimizing compilers. Fixes #10842.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine 2026-07-23 15:03:16 +02:00
parent 8572c4a99b
commit 66de304901
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog.d/mbedtls_ssl_set_hostname.txt Normal file
View File

@ -0,0 +1,7 @@
Bugfix
* Fix mbedtls_ssl_set_hostname(ssl, NULL) causing the connection to
fail when compiled with some versions of IAR in configurations
with MBEDTLS_SSL_SERVER_NAME_INDICATION disabled. Also fix
mbedtls_ssl_set_hostname(ssl, "") which could disable hostname
verification instead of requiring an empty hostname when compiled
with some optimizing compilers. Fixes #10842.

6
library/ssl_tls.c
View File

@ -2789,7 +2789,7 @@ void mbedtls_ssl_conf_groups(mbedtls_ssl_config *conf,
* mbedtls_ssl_set_hostname() has been called with `NULL`.
* If mbedtls_ssl_set_hostname() has never been called on `ssl`, then
* `ssl->hostname == NULL`. */
static const char *const ssl_hostname_skip_cn_verification = "";
static const char *const ssl_hostname_skip_cn_verification[] = { 0 };
#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
/** Whether mbedtls_ssl_set_hostname() has been called.
@ -2820,7 +2820,7 @@ static
#endif
const char *mbedtls_ssl_get_hostname_pointer(const mbedtls_ssl_context *ssl)
{
if (ssl->hostname == ssl_hostname_skip_cn_verification) {
if (ssl->hostname == (char *) ssl_hostname_skip_cn_verification) {
return NULL;
}
return ssl->hostname;
@ -2830,7 +2830,7 @@ const char *mbedtls_ssl_get_hostname_pointer(const mbedtls_ssl_context *ssl)
static void mbedtls_ssl_free_hostname(mbedtls_ssl_context *ssl)
{
if (ssl->hostname != NULL &&
ssl->hostname != ssl_hostname_skip_cn_verification) {
ssl->hostname != (char *) ssl_hostname_skip_cn_verification) {
mbedtls_zeroize_and_free(ssl->hostname, strlen(ssl->hostname));
}
ssl->hostname = NULL;