2020614 - tls13_CopyEchConfigs copies only the last config for every list entry

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P3)

Description

[Maurice Dauer [:mdauer]]

tls13_CopyEchConfigs in lib/ssl/tls13ech.c uses PR_LIST_TAIL(oConfigs) instead of the loop variable cur_p, causing every iteration to copy the last config in the source list rather than the current one.

lib/ssl/tls13ech.c:98:

for (PRCList *cur_p = PR_LIST_HEAD(oConfigs);
     cur_p != oConfigs;
     cur_p = PR_NEXT_LINK(cur_p)) {
    config = (sslEchConfig *)PR_LIST_TAIL(oConfigs);  // Bug: should be cur_p

The loop iterates with cur_p but never uses it. PR_LIST_TAIL(oConfigs) always yields the last element.

Comment 1

[John Schanck [:jschanck]]

Attachment: Bug 2020614 - tls13_CopyEchConfigs uses PR_LIST_TAIL instead of loop variable. r=djackson

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/d256e99566f5
tls13_CopyEchConfigs uses PR_LIST_TAIL instead of loop variable. r=djackson