patch for GHSA-8h38-qjhh-mf2h

edited by inspection not compiled or run-time tested

1 files changed, 11 insertions, 5 deletions

diff --git a/nx_secure/src/nx_secure_tls_psk_identity_find.c b/nx_secure/src/nx_secure_tls_psk_identity_find.c
index cae6c464..64e96f0d 100644
--- a/nx_secure/src/nx_secure_tls_psk_identity_find.c
+++ b/nx_secure/src/nx_secure_tls_psk_identity_find.c
@@ -89,12 +89,18 @@ UINT i;
     /* Loop through all PSKs, looking for a matching identity string. */
     for (i = 0; i < psk_list_size; ++i)
     {
-        /* Save off the PSK and its length. */
-        compare_val = (UINT)NX_SECURE_MEMCMP(tls_session -> nx_secure_tls_credentials.nx_secure_tls_psk_store[i].nx_secure_tls_psk_id, psk_identity, identity_length);
+        /* GHSA-8h38-qjhh-mf2h */
+        /* PSK length must be equal */
+    	  if (identity_length != tls_session -> nx_secure_tls_credentials.nx_secure_tls_psk_store[i].nx_secure_tls_psk_id_size) {
+    		    continue;
+    	  }
+      
+        /* compare the PSK using stored psk length */
+        compare_val = (UINT)NX_SECURE_MEMCMP(tls_session -> nx_secure_tls_credentials.nx_secure_tls_psk_store[i].nx_secure_tls_psk_id, psk_identity, 
+          tls_session -> nx_secure_tls_credentials.nx_secure_tls_psk_store[i].nx_secure_tls_psk_id_size);
 
-        /* See if the identity matched, and the length is the same (without the length, we could have a
-           matching prefix which could be a possible attack vector... */
-        if (compare_val == 0 && identity_length == tls_session -> nx_secure_tls_credentials.nx_secure_tls_psk_store[i].nx_secure_tls_psk_id_size)
+        /* See if the identity matched */
+        if (compare_val == 0)
         {
             /* Found a matching identity, return the associated PSK. */
             *psk_data = tls_session -> nx_secure_tls_credentials.nx_secure_tls_psk_store[i].nx_secure_tls_psk_data;