Prepare 0.19.1 with backport

rustls · Apr 17, 2021 · 3c390ef · 3c390ef
1 parent 47d3092
commit 3c390ef
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 2 deletions.
diff --git a/README.md b/README.md
@@ -23,6 +23,10 @@ If you'd like to help out, please see [CONTRIBUTING.md](CONTRIBUTING.md).
 * Next release:
   - Planned: removal of unused signature verification schemes at link-time.
   - Planned: removal of PEM parsing to a separate crate.
+* 0.19.1 (2021-04-17):
+  - Backport: fix security issue: there was a reachable panic in servers if a client
+    sent an invalid `ClientECDiffieHellmanPublic` encoding, due to an errant `unwrap()`
+    when parsing the encoding.
 * 0.19.0 (2020-11-22):
   - Ensured that `get_peer_certificates` is both better documented, and works
     uniformly for both full-handshake and resumed sessions.

diff --git a/rustls/Cargo.toml b/rustls/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rustls"
-version = "0.19.0"
+version = "0.19.1"
 edition = "2018"
 authors = ["Joseph Birr-Pixton <[email protected]>"]
 license = "Apache-2.0/ISC/MIT"

diff --git a/rustls/src/suites.rs b/rustls/src/suites.rs
@@ -91,7 +91,7 @@ impl KeyExchange {
 
     fn decode_client_params(&self, kx_params: &[u8]) -> Option<ClientECDHParams> {
         let mut rd = Reader::init(kx_params);
-        let ecdh_params = ClientECDHParams::read(&mut rd).unwrap();
+        let ecdh_params = ClientECDHParams::read(&mut rd)?;
         if rd.any_left() {
             None
         } else {