From 66de3049019e61a155c4aff93a76e1b9825691c2 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 23 Jul 2026 15:03:16 +0200 Subject: [PATCH] Fix possible duplication or deduplication of ssl_hostname_skip_cn_verification Fix mbedtls_ssl_set_hostname(ssl, NULL) causing the connection to fail when compiled with some versions of IAR in configurations with MBEDTLS_SSL_SERVER_NAME_INDICATION disabled. Also fix mbedtls_ssl_set_hostname(ssl, "") which could disable hostname verification instead of requiring an empty hostname when compiled with some optimizing compilers. Fixes #10842. Signed-off-by: Gilles Peskine --- ChangeLog.d/mbedtls_ssl_set_hostname.txt | 7 +++++++ library/ssl_tls.c | 6 +++--- 2 files changed, 10 insertions(+), 3 deletions(-) create mode 100644 ChangeLog.d/mbedtls_ssl_set_hostname.txt diff --git a/ChangeLog.d/mbedtls_ssl_set_hostname.txt b/ChangeLog.d/mbedtls_ssl_set_hostname.txt new file mode 100644 index 0000000000..780073386b --- /dev/null +++ b/ChangeLog.d/mbedtls_ssl_set_hostname.txt @@ -0,0 +1,7 @@ +Bugfix + * Fix mbedtls_ssl_set_hostname(ssl, NULL) causing the connection to + fail when compiled with some versions of IAR in configurations + with MBEDTLS_SSL_SERVER_NAME_INDICATION disabled. Also fix + mbedtls_ssl_set_hostname(ssl, "") which could disable hostname + verification instead of requiring an empty hostname when compiled + with some optimizing compilers. Fixes #10842. diff --git a/library/ssl_tls.c b/library/ssl_tls.c index b29986daa3..2756d851bb 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -2789,7 +2789,7 @@ void mbedtls_ssl_conf_groups(mbedtls_ssl_config *conf, * mbedtls_ssl_set_hostname() has been called with `NULL`. * If mbedtls_ssl_set_hostname() has never been called on `ssl`, then * `ssl->hostname == NULL`. */ -static const char *const ssl_hostname_skip_cn_verification = ""; +static const char *const ssl_hostname_skip_cn_verification[] = { 0 }; #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) /** Whether mbedtls_ssl_set_hostname() has been called. @@ -2820,7 +2820,7 @@ static #endif const char *mbedtls_ssl_get_hostname_pointer(const mbedtls_ssl_context *ssl) { - if (ssl->hostname == ssl_hostname_skip_cn_verification) { + if (ssl->hostname == (char *) ssl_hostname_skip_cn_verification) { return NULL; } return ssl->hostname; @@ -2830,7 +2830,7 @@ const char *mbedtls_ssl_get_hostname_pointer(const mbedtls_ssl_context *ssl) static void mbedtls_ssl_free_hostname(mbedtls_ssl_context *ssl) { if (ssl->hostname != NULL && - ssl->hostname != ssl_hostname_skip_cn_verification) { + ssl->hostname != (char *) ssl_hostname_skip_cn_verification) { mbedtls_zeroize_and_free(ssl->hostname, strlen(ssl->hostname)); } ssl->hostname = NULL;