From 7b81dcf90fca4791a0db016dbd2efbf838ae12f5 Mon Sep 17 00:00:00 2001 From: Shawn Carey Date: Thu, 13 May 2021 09:08:02 -0400 Subject: [PATCH 1/2] avoid -Wfree-nonheap-object when buiding with gcc11 Signed-off-by: Shawn Carey --- programs/test/udp_proxy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/programs/test/udp_proxy.c b/programs/test/udp_proxy.c index 66ead4aac8..b77994e033 100644 --- a/programs/test/udp_proxy.c +++ b/programs/test/udp_proxy.c @@ -991,8 +991,8 @@ exit: for( delay_idx = 0; delay_idx < MAX_DELAYED_HS; delay_idx++ ) { - mbedtls_free( opt.delay_cli + delay_idx ); - mbedtls_free( opt.delay_srv + delay_idx ); + mbedtls_free( opt.delay_cli[delay_idx] ); + mbedtls_free( opt.delay_srv[delay_idx] ); } mbedtls_net_free( &client_fd ); From 69c5f5d81cad0ff6ade16743659ac0df00b5c4c2 Mon Sep 17 00:00:00 2001 From: Shawn Carey Date: Thu, 13 May 2021 09:16:16 -0400 Subject: [PATCH 2/2] avoid -Wstringop-overflow when buiding with gcc11 Signed-off-by: Shawn Carey --- library/ssl_tls.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index c749a8611c..a00b439ef4 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -6364,8 +6364,6 @@ static void ssl_calc_finished_tls_sha256( #if defined(MBEDTLS_SHA512_C) -typedef int (*finish_sha384_t)(mbedtls_sha512_context*, unsigned char*); - static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *ssl, unsigned char *buf, int from ) { @@ -6373,12 +6371,6 @@ static void ssl_calc_finished_tls_sha384( const char *sender; mbedtls_sha512_context sha512; unsigned char padbuf[48]; - /* - * For SHA-384, we can save 16 bytes by keeping padbuf 48 bytes long. - * However, to avoid stringop-overflow warning in gcc, we have to cast - * mbedtls_sha512_finish_ret(). - */ - finish_sha384_t finish_sha384 = (finish_sha384_t)mbedtls_sha512_finish_ret; mbedtls_ssl_session *session = ssl->session_negotiate; if( !session ) @@ -6404,8 +6396,19 @@ static void ssl_calc_finished_tls_sha384( sender = ( from == MBEDTLS_SSL_IS_CLIENT ) ? "client finished" : "server finished"; - - finish_sha384( &sha512, padbuf ); + /* mbedtls_sha512_finish_ret's output parameter is declared as a + * 64-byte buffer, but sice we're using SHA-384, we know that the + * output fits in 48 bytes. This is correct C, but GCC 11.1 warns + * about it. + */ +#if defined(__GNUC__) && __GNUC__ >= 11 +#pragma GCC diagnostic push +#pragma GCC diagnostic ignored "-Wstringop-overflow" +#endif + mbedtls_sha512_finish_ret( &sha512, padbuf ); +#if defined(__GNUC__) && __GNUC__ >= 11 +#pragma GCC diagnostic pop +#endif ssl->handshake->tls_prf( session->master, 48, sender, padbuf, 48, buf, len );