romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-15 22:57:17 +03:00
Code Issues Projects Releases Packages Wiki Activity

mbedtls: check result of setting ALPN

Browse source 
The result of setting the negotiated ALPN was not checked, leading
to reporting success when it should not have.

Reported in Joshua's sarif data

Closes #18727
This commit is contained in:
Stefan Eissing 2025-09-25 12:53:37 +02:00 • committed by Daniel Stenberg
parent 36eb26381c
commit e02cbe94ff
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 7 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

12
lib/vtls/mbedtls.c
View file

@ -918,6 +918,7 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
static CURLcode
mbed_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
{
CURLcode result;
int ret;
struct ssl_connect_data *connssl = cf->ctx;
struct mbed_ssl_backend_data *backend =
@ -968,7 +969,6 @@ mbed_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
if(pinnedpubkey) {
int size;
CURLcode result;
const mbedtls_x509_crt *peercert;
mbedtls_x509_crt *p = NULL;
unsigned char *pubkey = NULL;
@ -1018,17 +1018,19 @@ pinnedpubkey_error:
mbedtls_x509_crt_free(p);
free(p);
free(pubkey);
if(result) {
if(result)
return result;
}
}
#ifdef HAS_ALPN_MBEDTLS
if(connssl->alpn) {
const char *proto = mbedtls_ssl_get_alpn_protocol(&backend->ssl);
Curl_alpn_set_negotiated(cf, data, connssl, (const unsigned char *)proto,
proto ? strlen(proto) : 0);
result = Curl_alpn_set_negotiated(cf, data, connssl,
(const unsigned char *)proto,
proto ? strlen(proto) : 0);
if(result)
return result;
}
#endif