Merge pull request #10442 from davidhorstmann-arm/verify-result-default-failure

Hardening: Make `mbedtls_ssl_get_verify_result()` default to failure
2026-08-31 15:29:57 +00:00 · 2026-03-17 10:36:38 +00:00
parent d7f2a4cdc6 937c70ac90
commit cb0b594a9d
8 changed files with 182 additions and 45 deletions
@@ -0,0 +1,5 @@
+Changes
+   * Harden mbedtls_ssl_get_verify_result() against misuse.
+     If the handshake has not yet been attempted, return -1u to indicate
+     that the result is not available. Previously the result of verification
+     was zero-initialized so the function would return 0 (indicating success).