use_psk_key parm used to memset to zero

Author: effbiae

src/internal.c

@@ -33223,21 +33223,27 @@ static int AddPSKtoPreMasterSecret(WOLFSSL* ssl)
 #endif
 
 #ifndef NO_PSK
-static void MakePSKPreMasterSecret(Arrays* arrays, word16 sz)
+static void MakePSKPreMasterSecret(Arrays* arrays, byte use_psk_key)
 {
     byte* pms = arrays->preMasterSecret;
+    word16 sz;
 
-    if ((int)arrays->psk_keySz > 0) {
-        /* sz + sz 0s + length of key + key */
+    /* sz + (use_psk_key ? sz 0s : sz unaltered) + length of psk + psk */
+    if (!use_psk_key) {
+        sz = (word16)arrays->preMasterSz;
         c16toa(sz, pms);
-        pms += OPAQUE16_LEN;
-
-        XMEMSET(pms, 0, sz);
-        pms += sz;
-
+        pms += OPAQUE16_LEN + sz;
+    }
+    if ((int)arrays->psk_keySz > 0) {
+        if (use_psk_key) {
+            sz = (word16)arrays->psk_keySz;
+            c16toa(sz, pms);
+            pms += OPAQUE16_LEN;
+            XMEMSET(pms, 0, sz);
+            pms += sz;
+        }
         c16toa(arrays->psk_keySz, pms);
         pms += OPAQUE16_LEN;
-
         XMEMCPY(pms, arrays->psk_key, arrays->psk_keySz);
         arrays->preMasterSz = sz + arrays->psk_keySz + OPAQUE16_LEN * 2;
         ForceZero(arrays->psk_key, arrays->psk_keySz);
@@ -33693,8 +33699,7 @@ int SendClientKeyExchange(WOLFSSL* ssl)
                     XMEMCPY(args->encSecret, ssl->arrays->client_identity,
                             args->encSz);
                     ssl->options.peerAuthGood = 1;
-                    MakePSKPreMasterSecret(ssl->arrays,
-                                           (word16)ssl->arrays->psk_keySz);
+                    MakePSKPreMasterSecret(ssl->arrays, 1);
                     break;
                 }
             #endif /* !NO_PSK */
@@ -34200,8 +34205,7 @@ int SendClientKeyExchange(WOLFSSL* ssl)
                     c16toa((word16)args->length, args->output);
                     args->encSz += args->length + OPAQUE16_LEN;
 
-                    MakePSKPreMasterSecret(ssl->arrays,
-                                           (word16)ssl->arrays->preMasterSz);
+                    MakePSKPreMasterSecret(ssl->arrays, 0);
                     break;
                 }
             #endif /* !NO_DH && !NO_PSK */
@@ -34220,8 +34224,7 @@ int SendClientKeyExchange(WOLFSSL* ssl)
 
                     /* Create pre master secret is the concatenation of
                      * eccSize + eccSharedKey + pskSize + pskKey */
-                    MakePSKPreMasterSecret(ssl->arrays,
-                                           (word16)ssl->arrays->preMasterSz);
+                    MakePSKPreMasterSecret(ssl->arrays, 0);
                     break;
                 }
             #endif /* (HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448) && !NO_PSK */
@@ -41027,8 +41030,7 @@ static int DefTicketEncCb(WOLFSSL* ssl, byte key_name[WOLFSSL_TICKET_NAME_SZ],
                         ssl->arrays->client_identity[ci_sz] = '\0'; /* null term */
                         if (AddPSKtoPreMasterSecret(ssl))
                             ERROR_OUT(PSK_KEY_ERROR, exit_dcke);
-                        MakePSKPreMasterSecret(ssl->arrays,
-                                               (word16)ssl->arrays->psk_keySz);
+                        MakePSKPreMasterSecret(ssl->arrays, 1);
                         break;
                     }
                 #endif /* !NO_PSK */
@@ -41835,8 +41837,7 @@ static int DefTicketEncCb(WOLFSSL* ssl, byte key_name[WOLFSSL_TICKET_NAME_SZ],
                          * preMasterSecret here. */
                         if (AddPSKtoPreMasterSecret(ssl))
                             ERROR_OUT(PSK_KEY_ERROR, exit_dcke);
-                        MakePSKPreMasterSecret(ssl->arrays,
-                                               (word16)ssl->arrays->preMasterSz);
+                        MakePSKPreMasterSecret(ssl->arrays, 0);
                         break;
                     }
                 #endif /* !NO_DH && !NO_PSK */
@@ -41856,8 +41857,7 @@ static int DefTicketEncCb(WOLFSSL* ssl, byte key_name[WOLFSSL_TICKET_NAME_SZ],
                          * preMasterSecret here. */
                         if (AddPSKtoPreMasterSecret(ssl))
                             ERROR_OUT(PSK_KEY_ERROR, exit_dcke);
-                        MakePSKPreMasterSecret(ssl->arrays,
-                                               (word16)ssl->arrays->preMasterSz);
+                        MakePSKPreMasterSecret(ssl->arrays, 0);
                         break;
                     }
                 #endif /* (HAVE_ECC || CURVE25519 || CURVE448) && !NO_PSK */