From afa648aa44c698f6f01b1dd653edc3dfbe140355 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Thu, 22 Oct 2026 10:53:45 +0100 Subject: [PATCH] Fix non-PSA TLS 1.3 transform cleanup Signed-off-by: Ben Taylor --- ChangeLog.d/tls13-transform-resource-leak.txt | 6 +++--- library/ssl_tls13_keys.c | 6 ++++++ 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/ChangeLog.d/tls13-transform-resource-leak.txt b/ChangeLog.d/tls13-transform-resource-leak.txt index f8008e4723..98cad09d90 100644 --- a/ChangeLog.d/tls13-transform-resource-leak.txt +++ b/ChangeLog.d/tls13-transform-resource-leak.txt @@ -1,4 +1,4 @@ Bugfix - * Fix a resource leak in TLS 1.3 transform setup when importing the - decryption traffic key fails after the encryption traffic key has already - been imported. Fixes #10917. + * Fix resource leaks in TLS 1.3 transform setup when a setup step fails + after allocating cipher contexts or importing the encryption traffic key. + Fixes #10917. diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c index ef91413bac..bd8d8c5508 100644 --- a/library/ssl_tls13_keys.c +++ b/library/ssl_tls13_keys.c @@ -977,6 +977,7 @@ int mbedtls_ssl_tls13_populate_transform( if ((ret = mbedtls_cipher_setup(&transform->cipher_ctx_dec, cipher_info)) != 0) { MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_setup", ret); + mbedtls_ssl_transform_free(transform); return ret; } #endif /* MBEDTLS_USE_PSA_CRYPTO */ @@ -999,6 +1000,9 @@ int mbedtls_ssl_tls13_populate_transform( #endif /* MBEDTLS_SSL_CLI_C */ { /* should not happen */ +#if !defined(MBEDTLS_USE_PSA_CRYPTO) + mbedtls_ssl_transform_free(transform); +#endif return MBEDTLS_ERR_SSL_INTERNAL_ERROR; } @@ -1010,6 +1014,7 @@ int mbedtls_ssl_tls13_populate_transform( key_enc, (int) mbedtls_cipher_info_get_key_bitlen(cipher_info), MBEDTLS_ENCRYPT)) != 0) { MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_setkey", ret); + mbedtls_ssl_transform_free(transform); return ret; } @@ -1017,6 +1022,7 @@ int mbedtls_ssl_tls13_populate_transform( key_dec, (int) mbedtls_cipher_info_get_key_bitlen(cipher_info), MBEDTLS_DECRYPT)) != 0) { MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_cipher_setkey", ret); + mbedtls_ssl_transform_free(transform); return ret; } #endif /* MBEDTLS_USE_PSA_CRYPTO */