From f595df4569c1a1650ad9d077e2f2e819e9f1dddb Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Thu, 14 May 2026 11:27:05 +0100 Subject: [PATCH] ssl: propagate transcript-hash computation failures Signed-off-by: Ben Taylor --- library/ssl_tls.c | 1 + library/ssl_tls13_server.c | 1 + 2 files changed, 2 insertions(+) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 88aaf85d29..f6fcf63526 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -7092,6 +7092,7 @@ static int ssl_compute_master(mbedtls_ssl_handshake_params *handshake, ret = handshake->calc_verify(ssl, session_hash, &seed_len); if (ret != 0) { MBEDTLS_SSL_DEBUG_RET(1, "calc_verify", ret); + return ret; } MBEDTLS_SSL_DEBUG_BUF(3, "session hash for extended master secret", diff --git a/library/ssl_tls13_server.c b/library/ssl_tls13_server.c index 11b97d06bf..0021c3fd88 100644 --- a/library/ssl_tls13_server.c +++ b/library/ssl_tls13_server.c @@ -3098,6 +3098,7 @@ static int ssl_tls13_process_client_finished(mbedtls_ssl_context *ssl) if (ret != 0) { MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_compute_resumption_master_secret", ret); + return ret; } mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_WRAPUP);