From b368a7a1b941f8cdf85ac5a8981153eb876fc46a Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 7 Jul 2026 14:41:42 +0200 Subject: [PATCH] library: ssl: remove usage of MBEDTLS_ECP_DP_MAX MBEDTLS_ECP_DP_MAX is defined in 'ecp.h' which is a tf-psa-crypto private header. Instead of relying on that value define a new function named 'mbedtls_ssl_get_supported_tls_id_count' which returns the number of entries in 'tls_id_match_table'. Rationale: it does not have too much sense to allocate an array for TLS IDs which is larger than the list of supported TLS IDs in the current build. Signed-off-by: Valerio Setti --- library/ssl_misc.h | 9 +++++++++ library/ssl_tls.c | 5 +++++ library/ssl_tls12_server.c | 4 ++-- 3 files changed, 16 insertions(+), 2 deletions(-) diff --git a/library/ssl_misc.h b/library/ssl_misc.h index 1957d6a4c6..ecd3e6cc07 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -1541,6 +1541,15 @@ int mbedtls_ssl_is_tls_id_supported(uint16_t tls_id); */ uint16_t mbedtls_ssl_get_tls_id_from_curve_info(psa_ecc_family_t family, size_t bits); +/** + * \brief Return the number of supported TLS group IDs + 1. + * + * \return Number of supported TLS group IDs in \c tls_id_match_table + 1. + * In other words the returned value concides with the array length + * of \c tls_id_match_table. + */ +size_t mbedtls_ssl_get_supported_tls_id_count(void); + #if defined(MBEDTLS_DEBUG_C) /** * \brief Return EC's name for the specified TLS ID. diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 036007fc7d..d47d4d6a3d 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -5871,6 +5871,11 @@ uint16_t mbedtls_ssl_get_tls_id_from_curve_info(psa_ecc_family_t family, size_t return 0; } +size_t mbedtls_ssl_get_supported_tls_id_count(void) +{ + return ARRAY_LENGTH(tls_id_match_table); +} + #if defined(MBEDTLS_DEBUG_C) mbedtls_ssl_iana_tls_group_info_t mbedtls_ssl_iana_tls_group_info[] = MBEDTLS_SSL_IANA_TLS_GROUPS_INFO; diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c index 6de21b1429..cb0d0e5126 100644 --- a/library/ssl_tls12_server.c +++ b/library/ssl_tls12_server.c @@ -202,8 +202,8 @@ static int ssl_parse_supported_groups_ext(mbedtls_ssl_context *ssl, /* Don't allow our peer to make us allocate too much memory, * and leave room for a final 0 */ our_size = list_size / 2 + 1; - if (our_size > MBEDTLS_ECP_DP_MAX) { - our_size = MBEDTLS_ECP_DP_MAX; + if (our_size > mbedtls_ssl_get_supported_tls_id_count()) { + our_size = mbedtls_ssl_get_supported_tls_id_count(); } if ((curves_tls_id = mbedtls_calloc(our_size,