lib: fix a potential segfault in _gnutls13_recv_finished

In _gnutls13_recv_finished(), 'buf' is not initialized or set when
_gnutls13_compute_finished() returns an err, and goto cleanup may
cause a segfault crash as it frees the uninitialized buf.allocd in
_gnutls_buffer_clear().

So fix it by return if _gnutls13_compute_finished() returns an err
in _gnutls13_recv_finished().

Signed-off-by: Xin Long <lucien.xin@gmail.com>

diff --git a/lib/tls13/finished.c b/lib/tls13/finished.c
index 91e940702d3405f675d56098140c100f7bbd6d39..422e7d3fea0826d3c108f0e19c08a3d472f54f35 100644 (file)
--- a/lib/tls13/finished.c
+++ b/lib/tls13/finished.c
@@ -82,10 +82,8 @@ int _gnutls13_recv_finished(gnutls_session_t session)
        ret = _gnutls13_compute_finished(
                session->security_parameters.prf, base_key,
                &session->internals.handshake_hash_buffer, verifier);
-       if (ret < 0) {
-               gnutls_assert();
-               goto cleanup;
-       }
+       if (ret < 0)
+               return gnutls_assert_val(ret);
 
        ret = _gnutls_recv_handshake(session, GNUTLS_HANDSHAKE_FINISHED, 0,
                                     &buf);