Skip to content

Commit 6f386fd

Browse files
JacobBarthelmehJacobBarthelmeh
authored
Merge pull request wolfSSL#9981 from julek-wolfssl/fenrir/260316
Fenrir fixes
2 parents a51b40b + 7c92fb2 commit 6f386fd

14 files changed

Lines changed: 107 additions & 97 deletions

File tree

‎.github/workflows/haproxy.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ jobs:
7272

7373
- name: Download haproxy if needed
7474
if: steps.cache-haproxy.outputs.cache-hit != 'true'
75-
uses: actions/checkout@v3
75+
uses: actions/checkout@v4
7676
with:
7777
repository: haproxy/haproxy
7878
ref: ${{matrix.haproxy_ref}}

‎.github/workflows/msys2.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
run:
2121
shell: msys2 {0}
2222
steps:
23-
- uses: actions/checkout@v3
23+
- uses: actions/checkout@v4
2424
- uses: msys2/setup-msys2@v2
2525
with:
2626
msystem: msys

‎.github/workflows/threadx.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
steps:
1616
- name: Cache NetXDuo bundle
1717
id: cache-netxduo
18-
uses: actions/cache@v3
18+
uses: actions/cache@v4
1919
with:
2020
path: ./v6.4.3_rel.tar.gz
2121
key: netxduo-bundle-v6.4.3_rel

‎src/internal.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7976,7 +7976,7 @@ int InitSSL(WOLFSSL* ssl, WOLFSSL_CTX* ctx, int writeDup)
79767976
(unsigned long)wolfSSL_X509_VERIFY_PARAM_get_flags(
79777977
wolfSSL_CTX_get0_param(ctx))) != WOLFSSL_SUCCESS) {
79787978
WOLFSSL_MSG("ssl->param set flags error");
7979-
return WOLFSSL_FAILURE;
7979+
return BAD_STATE_E;
79807980
}
79817981
#endif
79827982

@@ -8137,7 +8137,7 @@ int InitSSL(WOLFSSL* ssl, WOLFSSL_CTX* ctx, int writeDup)
81378137
if (ctx->quic.method) {
81388138
ret = wolfSSL_set_quic_method(ssl, ctx->quic.method);
81398139
if (ret != WOLFSSL_SUCCESS)
8140-
return ret;
8140+
return WOLFSSL_FATAL_ERROR;
81418141
}
81428142
#endif
81438143

@@ -14988,6 +14988,7 @@ int LoadCertByIssuer(WOLFSSL_X509_STORE* store, X509_NAME* issuer, int type)
1498814988
#elif !defined(NO_SHA)
1498914989
retHash = wc_ShaHash((const byte*)pbuf, (word32)len, dgt);
1499014990
#endif
14991+
wolfSSL_OPENSSL_free(pbuf);
1499114992
if (retHash == 0) {
1499214993
/* 4 bytes in little endian as unsigned long */
1499314994
hash = (((unsigned long)dgt[3] << 24) |
@@ -14998,7 +14999,6 @@ int LoadCertByIssuer(WOLFSSL_X509_STORE* store, X509_NAME* issuer, int type)
1499814999
WOLFSSL_MSG("failed hash operation");
1499915000
return WOLFSSL_FAILURE;
1500015001
}
15001-
wolfSSL_OPENSSL_free(pbuf);
1500215002
}
1500315003

1500415004
/* try to load each hashed name file in path */

‎src/pk_rsa.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3899,7 +3899,7 @@ int wolfSSL_RSA_GenAdd(WOLFSSL_RSA* rsa)
38993899
}
39003900
}
39013901

3902-
mp_clear(t);
3902+
mp_forcezero(t);
39033903

39043904
#ifdef WOLFSSL_SMALL_STACK
39053905
if (rsa != NULL) {

‎src/ssl_sess.c‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2930,24 +2930,33 @@ WOLFSSL_SESSION* wolfSSL_d2i_SSL_SESSION(WOLFSSL_SESSION** sess,
29302930
#endif
29312931
#if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)
29322932
#ifdef WOLFSSL_TLS13
2933-
if (i - idx < (OPAQUE32_LEN * 2)) {
2933+
2934+
#ifdef WOLFSSL_32BIT_MILLI_TIME
2935+
if (i - idx < OPAQUE32_LEN) {
29342936
ret = BUFFER_ERROR;
29352937
goto end;
29362938
}
2937-
#ifdef WOLFSSL_32BIT_MILLI_TIME
29382939
ato32(data + idx, &s->ticketSeen);
29392940
idx += OPAQUE32_LEN;
29402941
#else
2942+
if (i - idx < (OPAQUE32_LEN * 2)) {
2943+
ret = BUFFER_ERROR;
2944+
goto end;
2945+
}
29412946
{
29422947
word32 seenHi, seenLo;
2943-
29442948
ato32(data + idx, &seenHi);
29452949
idx += OPAQUE32_LEN;
29462950
ato32(data + idx, &seenLo);
29472951
idx += OPAQUE32_LEN;
29482952
s->ticketSeen = ((sword64)seenHi << 32) + seenLo;
29492953
}
29502954
#endif
2955+
2956+
if (i - idx < OPAQUE32_LEN) {
2957+
ret = BUFFER_ERROR;
2958+
goto end;
2959+
}
29512960
ato32(data + idx, &s->ticketAdd);
29522961
idx += OPAQUE32_LEN;
29532962
if (i - idx < OPAQUE8_LEN) {

‎tests/api.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33629,14 +33629,13 @@ int test_wc_LmsKey_reload_cache(void);
3362933629
static int test_lms_write_key(const byte* priv, word32 privSz, void* context)
3363033630
{
3363133631
FILE* f = fopen((const char*)context, "wb");
33632+
int ret = WC_LMS_RC_SAVED_TO_NV_MEMORY;
3363233633
if (f == NULL)
3363333634
return -1;
33634-
if (fwrite(priv, 1, privSz, f) != privSz) {
33635-
fclose(f);
33636-
return -1;
33637-
}
33635+
if (fwrite(priv, 1, privSz, f) != privSz)
33636+
ret = -1;
3363833637
fclose(f);
33639-
return WC_LMS_RC_SAVED_TO_NV_MEMORY;
33638+
return ret;
3364033639
}
3364133640

3364233641
static int test_lms_read_key(byte* priv, word32 privSz, void* context)

‎wolfcrypt/src/asn.c‎

Lines changed: 23 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -9491,14 +9491,15 @@ int wc_GetKeyOID(byte* key, word32 keySz, const byte** curveOID, word32* oidSz,
94919491
if (rsa == NULL)
94929492
return MEMORY_E;
94939493

9494-
wc_InitRsaKey(rsa, heap);
9495-
if (wc_RsaPrivateKeyDecode(key, &tmpIdx, rsa, keySz) == 0) {
9496-
*algoID = RSAk;
9497-
}
9498-
else {
9499-
WOLFSSL_MSG("Not RSA DER key");
9494+
if (wc_InitRsaKey(rsa, heap) == 0) {
9495+
if (wc_RsaPrivateKeyDecode(key, &tmpIdx, rsa, keySz) == 0) {
9496+
*algoID = RSAk;
9497+
}
9498+
else {
9499+
WOLFSSL_MSG("Not RSA DER key");
9500+
}
9501+
wc_FreeRsaKey(rsa);
95009502
}
9501-
wc_FreeRsaKey(rsa);
95029503
XFREE(rsa, heap, DYNAMIC_TYPE_TMP_BUFFER);
95039504
}
95049505
#endif /* !NO_RSA && !NO_ASN_CRYPT */
@@ -9509,22 +9510,23 @@ int wc_GetKeyOID(byte* key, word32 keySz, const byte** curveOID, word32* oidSz,
95099510
return MEMORY_E;
95109511

95119512
tmpIdx = 0;
9512-
wc_ecc_init_ex(ecc, heap, INVALID_DEVID);
9513-
if (wc_EccPrivateKeyDecode(key, &tmpIdx, ecc, keySz) == 0) {
9514-
*algoID = ECDSAk;
9515-
9516-
/* now find oid */
9517-
if (wc_ecc_get_oid(ecc->dp->oidSum, curveOID, oidSz) < 0) {
9518-
WOLFSSL_MSG("Error getting ECC curve OID");
9519-
wc_ecc_free(ecc);
9520-
XFREE(ecc, heap, DYNAMIC_TYPE_TMP_BUFFER);
9521-
return BAD_FUNC_ARG;
9513+
if (wc_ecc_init_ex(ecc, heap, INVALID_DEVID) == 0) {
9514+
if (wc_EccPrivateKeyDecode(key, &tmpIdx, ecc, keySz) == 0) {
9515+
*algoID = ECDSAk;
9516+
9517+
/* now find oid */
9518+
if (wc_ecc_get_oid(ecc->dp->oidSum, curveOID, oidSz) < 0) {
9519+
WOLFSSL_MSG("Error getting ECC curve OID");
9520+
wc_ecc_free(ecc);
9521+
XFREE(ecc, heap, DYNAMIC_TYPE_TMP_BUFFER);
9522+
return BAD_FUNC_ARG;
9523+
}
95229524
}
9525+
else {
9526+
WOLFSSL_MSG("Not ECC DER key either");
9527+
}
9528+
wc_ecc_free(ecc);
95239529
}
9524-
else {
9525-
WOLFSSL_MSG("Not ECC DER key either");
9526-
}
9527-
wc_ecc_free(ecc);
95289530
XFREE(ecc, heap, DYNAMIC_TYPE_TMP_BUFFER);
95299531
}
95309532
#endif /* HAVE_ECC && !NO_ASN_CRYPT */

‎wolfcrypt/src/dh.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1465,7 +1465,7 @@ static int wc_DhGenerateKeyPair_Async(DhKey* key, WC_RNG* rng,
14651465
if (ret == MP_OKAY)
14661466
ret = IntelQaDhKeyGen(&key->asyncDev, &key->p.raw, &key->g.raw,
14671467
&x.raw, pub, pubSz);
1468-
mp_clear(&x);
1468+
mp_forcezero(&x);
14691469

14701470
return ret;
14711471
}

‎wolfcrypt/src/dilithium.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8026,6 +8026,7 @@ static int dilithium_make_key(dilithium_key* key, WC_RNG* rng)
80268026
ret = wc_dilithium_make_key_from_seed(key, seed);
80278027
}
80288028

8029+
ForceZero(seed, sizeof(seed));
80298030
return ret;
80308031
}
80318032
#endif /* !WOLFSSL_DILITHIUM_NO_MAKE_KEY */

0 commit comments

Comments
 (0)