From 5631e99abc93f5ebde8ffc33cbcabe845b555976 Mon Sep 17 00:00:00 2001 From: Ashish Sharma Date: Mon, 28 Jul 2025 14:07:05 +0800 Subject: [PATCH] feat(mbedtls): skip memset ssl buffers with dynamic buffer enabled. As with dynamic buffer feature enabled, the buffers are handled dynamically, there is no need to memset these on connection reset. This can help to save some heap memory allocation. --- library/pk.c | 2 ++ library/ssl_tls.c | 6 ++++++ sbom.yml | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/library/pk.c b/library/pk.c index b48b6cb23f..44cdc5be2e 100644 --- a/library/pk.c +++ b/library/pk.c @@ -1443,6 +1443,7 @@ int mbedtls_pk_sign_ext(mbedtls_pk_type_t pk_type, sig, sig_size, sig_len); #else /* MBEDTLS_USE_PSA_CRYPTO */ +#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT) if (ctx->pk_info->type == MBEDTLS_PK_RSA_ALT) { mbedtls_rsa_alt_context *rsa_alt = ctx->pk_ctx; mbedtls_rsa_context *rsa = (mbedtls_rsa_context *)rsa_alt->key; @@ -1452,6 +1453,7 @@ int mbedtls_pk_sign_ext(mbedtls_pk_type_t pk_type, sig, sig_size, sig_len, f_rng, p_rng); } } +#endif /* MBEDTLS_PK_RSA_ALT_SUPPORT */ if (sig_size < mbedtls_pk_get_len(ctx)) { return MBEDTLS_ERR_PK_BUFFER_TOO_SMALL; diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 1185b0b283..1bb366d692 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -1478,6 +1478,12 @@ void mbedtls_ssl_session_reset_msg_layer(mbedtls_ssl_context *ssl, #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) size_t in_buf_len = ssl->in_buf_len; size_t out_buf_len = ssl->out_buf_len; +/* ESP Change: For dynamic buffer feature, the buffer allocation shall be + * handled on-demand basis and hence skip the memset in this API on the buffer pointers + */ +#elif defined(CONFIG_MBEDTLS_DYNAMIC_BUFFER) + size_t in_buf_len = 0; + size_t out_buf_len = 0; #else size_t in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN; size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN; diff --git a/sbom.yml b/sbom.yml index e15b1d53e1..ef39887fd7 100644 --- a/sbom.yml +++ b/sbom.yml @@ -7,6 +7,10 @@ cve-keywords: - mbed tls - mbedtls cve-exclude-list: + - cve: CVE-2025-54764 + reason: Fixed in 3.6.5 + - cve: CVE-2025-59438 + reason: Fixed in 3.6.5 - cve: CVE-2025-52496 reason: Fixed in 3.6.4 - cve: CVE-2025-27810