commit b1edaec18fa9536f193b2fbace66adaf357e3941
author Gilles Peskine <Gilles.Peskine@arm.com> Fri Jun 11 22:41:46 2021 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> Fri Jun 11 22:41:46 2021 +0200
tree dc2119adf8d986df5aaa7ad3fdec3b9eb5712699
parent 93038fab2c39579b2aaab2aceb8d155e77ecb250

Fix missing state check for tls12_prf output

Fix PSA_ALG_TLS12_PRF and PSA_ALG_TLS12_PSK_TO_MS being too permissive
about missing inputs.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

ChangeLog.d/psa_key_derivation-bad_workflow.txt

diff --git a/ChangeLog.d/psa_key_derivation-bad_workflow.txt b/ChangeLog.d/psa_key_derivation-bad_workflow.txt
new file mode 100644
index 0000000..7fd03e6
--- /dev/null
+++ b/ChangeLog.d/psa_key_derivation-bad_workflow.txt
@@ -0,0 +1,3 @@
+Bugfix
+   * Fix PSA_ALG_TLS12_PRF and PSA_ALG_TLS12_PSK_TO_MS being too permissive
+     about missing inputs.

library/psa_crypto.c

diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index db44e3f..d8a5d82 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -3731,6 +3731,17 @@
     psa_status_t status;
     uint8_t offset, length;
 
+    switch( tls12_prf->state )
+    {
+        case PSA_TLS12_PRF_STATE_LABEL_SET:
+            tls12_prf->state = PSA_TLS12_PRF_STATE_OUTPUT;
+            break;
+        case PSA_TLS12_PRF_STATE_OUTPUT:
+            break;
+        default:
+            return( PSA_ERROR_BAD_STATE );
+    }
+
     while( output_length != 0 )
     {
         /* Check if we have fully processed the current block. */