From 005072c87e7f9742e61b3ad8e873d8195fe0b73c Mon Sep 17 00:00:00 2001 From: Aditya Patwardhan Date: Mon, 25 May 2026 20:28:59 +0530 Subject: [PATCH] fix(esp-tls): call mbedtls_pk_init before mbedtls_pk_wrap_psa in PSA key paths Per mbedTLS API contract, mbedtls_pk_context must be explicitly initialized with mbedtls_pk_init() before calling mbedtls_pk_wrap_psa(). Add the missing init calls for both the server_key and client_key PSA-backed key code paths. --- components/esp-tls/esp_tls_mbedtls.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/components/esp-tls/esp_tls_mbedtls.c b/components/esp-tls/esp_tls_mbedtls.c index 9d62b5debea..c53fff5a033 100644 --- a/components/esp-tls/esp_tls_mbedtls.c +++ b/components/esp-tls/esp_tls_mbedtls.c @@ -768,6 +768,7 @@ static esp_err_t set_server_config(esp_tls_cfg_server_t *cfg, esp_tls_t *tls) return ESP_ERR_INVALID_ARG; } mbedtls_svc_key_id_t key_id = cfg->server_key->psa.key_id; + mbedtls_pk_init(&tls->serverkey); ret = mbedtls_pk_wrap_psa(&tls->serverkey, key_id); if (ret != 0) { ESP_LOGE(TAG, "mbedtls_pk_wrap_psa returned -0x%04X", -ret); @@ -1031,6 +1032,7 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t return ESP_ERR_INVALID_ARG; } mbedtls_svc_key_id_t key_id = cfg->client_key->psa.key_id; + mbedtls_pk_init(&tls->clientkey); ret = mbedtls_pk_wrap_psa(&tls->clientkey, key_id); if (ret != 0) { ESP_LOGE(TAG, "mbedtls_pk_wrap_psa returned -0x%04X", -ret);