Skip to content

Commit 215a510

Browse files
ColtonWilleyColtonWilley
committed
Add zeroize on init for AES-CTR, memset test buffers to make valgrind happy, add valgrind suppression file.
1 parent c80dff9 commit 215a510

10 files changed

Lines changed: 13745 additions & 10 deletions

File tree

‎src/we_aes_ctr.c‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -195,13 +195,20 @@ static int we_aes_ctr_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr)
195195

196196
/* Get the AES-CTR data to work with. */
197197
aes = (we_AesCtr *)EVP_CIPHER_CTX_get_cipher_data(ctx);
198-
if (aes != NULL) {
198+
if (aes == NULL) {
199199
WOLFENGINE_ERROR_FUNC_NULL(WE_LOG_CIPHER,
200200
"EVP_CIPHER_CTX_get_cipher_data", aes);
201201
ret = 0;
202202
}
203203
if (ret == 1) {
204204
switch (type) {
205+
case EVP_CTRL_INIT:
206+
{
207+
if (aes != NULL) {
208+
XMEMSET(aes, 0, sizeof(we_AesCtr));
209+
}
210+
break;
211+
}
205212
default:
206213
XSNPRINTF(errBuff, sizeof(errBuff), "Unsupported ctrl type %d",
207214
type);
@@ -219,6 +226,7 @@ static int we_aes_ctr_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr)
219226
/** Flags for AES-CTR method. */
220227
#define AES_CTR_FLAGS \
221228
(EVP_CIPH_ALWAYS_CALL_INIT | \
229+
EVP_CIPH_CTRL_INIT | \
222230
EVP_CIPH_FLAG_CUSTOM_CIPHER | \
223231
EVP_CIPH_FLAG_DEFAULT_ASN1 | \
224232
EVP_CIPH_CTR_MODE)

‎test/test_aestag.c‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -349,6 +349,9 @@ static int test_aes_tag_fixed(ENGINE *e, void *data, const EVP_CIPHER *cipher,
349349

350350
(void)data;
351351

352+
XMEMSET(key, 0, sizeof(key));
353+
XMEMSET(iv, 0, sizeof(iv));
354+
352355
if (RAND_bytes(key, keyLen) == 0) {
353356
err = 1;
354357
}
@@ -509,6 +512,10 @@ static int test_aes_tag_tls(ENGINE *e, void *data, const EVP_CIPHER *cipher,
509512

510513
(void)data;
511514

515+
XMEMSET(key, 0, sizeof(key));
516+
XMEMSET(iv, 0, sizeof(iv));
517+
XMEMSET(msg, 0, sizeof(msg));
518+
512519
aad[8] = 23; /* Content type */
513520
aad[9] = 3; /* Protocol major version */
514521
aad[10] = 2; /* Protocol minor version */

‎test/test_cipher.c‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,10 @@ static int test_cipher_enc_dec(ENGINE *e, void *data, const EVP_CIPHER *cipher,
105105

106106
(void)data;
107107

108+
/* Must memset to make valgrind happy */
109+
XMEMSET(key, 0, sizeof(key));
110+
XMEMSET(iv, 0, sizeof(iv));
111+
108112
if (RAND_bytes(key, keyLen) != 1) {
109113
err = 1;
110114
}
@@ -218,7 +222,7 @@ static int test_stream_dec(ENGINE *e, const EVP_CIPHER *cipher,
218222
int encLen, unsigned char *dec)
219223
{
220224
int err;
221-
EVP_CIPHER_CTX *ctx;
225+
EVP_CIPHER_CTX *ctx = NULL;
222226
int dLen;
223227
int decLen;
224228
int i;
@@ -280,6 +284,12 @@ static int test_stream_enc_dec(ENGINE *e, void *data, const EVP_CIPHER *cipher,
280284

281285
(void)data;
282286

287+
/* Must memset to make valgrind happy */
288+
XMEMSET(key, 0, sizeof(key));
289+
XMEMSET(iv, 0, sizeof(iv));
290+
XMEMSET(enc, 0, sizeof(enc));
291+
XMEMSET(encExp, 0, sizeof(encExp));
292+
283293
if (RAND_bytes(key, keyLen) != 1) {
284294
printf("generate key failed\n");
285295
err = 1;
@@ -674,6 +684,9 @@ int test_aes_ctr_iv_init_regression(ENGINE *e, void *data)
674684

675685
(void)data;
676686

687+
XMEMSET(iv, 0, sizeof(iv));
688+
XMEMSET(key, 0, sizeof(key));
689+
677690
/* Generate a random IV and key. */
678691
err = RAND_bytes(iv, AES_BLOCK_SIZE) != 1;
679692
if (err == 0) {

‎test/test_digest.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,10 @@ static int test_create_digest(const EVP_MD *md, ENGINE *e, void *data)
7979

8080
(void)data;
8181

82+
/* Must memset longMsg to make valgrind happy */
83+
XMEMSET(digest, 0, sizeof(digest));
84+
XMEMSET(longMsg, 0, sizeof(longMsg));
85+
8286
RAND_bytes(longMsg, sizeof(longMsg));
8387

8488
dLen = 0;

‎test/test_ecc.c‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -879,6 +879,9 @@ int test_ecdsa_p192_pkey(ENGINE *e, void *data)
879879

880880
(void)data;
881881

882+
XMEMSET(buf, 0, sizeof(buf));
883+
XMEMSET(ecdsaSig, 0, sizeof(ecdsaSig));
884+
882885
err = RAND_bytes(buf, sizeof(buf)) == 0;
883886
if (err == 0) {
884887
pkey = d2i_PrivateKey(EVP_PKEY_EC, NULL, &p, sizeof(ecc_key_der_192));
@@ -946,6 +949,9 @@ int test_ecdsa_p224_pkey(ENGINE *e, void *data)
946949

947950
(void)data;
948951

952+
XMEMSET(buf, 0, sizeof(buf));
953+
XMEMSET(ecdsaSig, 0, sizeof(ecdsaSig));
954+
949955
err = RAND_bytes(buf, sizeof(buf)) == 0;
950956
if (err == 0) {
951957
pkey = d2i_PrivateKey(EVP_PKEY_EC, NULL, &p, sizeof(ecc_key_der_224));
@@ -1001,6 +1007,9 @@ int test_ecdsa_p256_pkey(ENGINE *e, void *data)
10011007

10021008
(void)data;
10031009

1010+
XMEMSET(buf, 0, sizeof(buf));
1011+
XMEMSET(ecdsaSig, 0, sizeof(ecdsaSig));
1012+
10041013
err = RAND_bytes(buf, sizeof(buf)) == 0;
10051014
if (err == 0) {
10061015
pkey = d2i_PrivateKey(EVP_PKEY_EC, NULL, &p, sizeof(ecc_key_der_256));
@@ -1056,6 +1065,9 @@ int test_ecdsa_p384_pkey(ENGINE *e, void *data)
10561065

10571066
(void)data;
10581067

1068+
XMEMSET(buf, 0, sizeof(buf));
1069+
XMEMSET(ecdsaSig, 0, sizeof(ecdsaSig));
1070+
10591071
err = RAND_bytes(buf, sizeof(buf)) == 0;
10601072
if (err == 0) {
10611073
pkey = d2i_PrivateKey(EVP_PKEY_EC, NULL, &p, sizeof(ecc_key_der_384));
@@ -1111,6 +1123,8 @@ int test_ecdsa_p521_pkey(ENGINE *e, void *data)
11111123

11121124
(void)data;
11131125

1126+
XMEMSET(buf, 0, sizeof(buf));
1127+
11141128
err = RAND_bytes(buf, sizeof(buf)) == 0;
11151129
if (err == 0) {
11161130
pkey = d2i_PrivateKey(EVP_PKEY_EC, NULL, &p, sizeof(ecc_key_der_521));
@@ -1166,6 +1180,9 @@ int test_ecdsa_p192(ENGINE *e, void *data)
11661180

11671181
(void)data;
11681182

1183+
XMEMSET(buf, 0, sizeof(buf));
1184+
XMEMSET(ecdsaSig, 0, sizeof(ecdsaSig));
1185+
11691186
err = RAND_bytes(buf, sizeof(buf)) == 0;
11701187
if (err == 0) {
11711188
pkey = d2i_PrivateKey(EVP_PKEY_EC, NULL, &p, sizeof(ecc_key_der_192));
@@ -1234,6 +1251,9 @@ int test_ecdsa_p224(ENGINE *e, void *data)
12341251

12351252
(void)data;
12361253

1254+
XMEMSET(buf, 0, sizeof(buf));
1255+
XMEMSET(ecdsaSig, 0, sizeof(ecdsaSig));
1256+
12371257
err = RAND_bytes(buf, sizeof(buf)) == 0;
12381258
if (err == 0) {
12391259
pkey = d2i_PrivateKey(EVP_PKEY_EC, NULL, &p, sizeof(ecc_key_der_224));
@@ -1289,6 +1309,9 @@ int test_ecdsa_p256(ENGINE *e, void *data)
12891309

12901310
(void)data;
12911311

1312+
XMEMSET(buf, 0, sizeof(buf));
1313+
XMEMSET(ecdsaSig, 0, sizeof(ecdsaSig));
1314+
12921315
err = RAND_bytes(buf, sizeof(buf)) == 0;
12931316
if (err == 0) {
12941317
pkey = d2i_PrivateKey(EVP_PKEY_EC, NULL, &p, sizeof(ecc_key_der_256));
@@ -1344,6 +1367,9 @@ int test_ecdsa_p384(ENGINE *e, void *data)
13441367

13451368
(void)data;
13461369

1370+
XMEMSET(buf, 0, sizeof(buf));
1371+
XMEMSET(ecdsaSig, 0, sizeof(ecdsaSig));
1372+
13471373
err = RAND_bytes(buf, sizeof(buf)) == 0;
13481374
if (err == 0) {
13491375
pkey = d2i_PrivateKey(EVP_PKEY_EC, NULL, &p, sizeof(ecc_key_der_384));
@@ -1399,6 +1425,9 @@ int test_ecdsa_p521(ENGINE *e, void *data)
13991425

14001426
(void)data;
14011427

1428+
XMEMSET(buf, 0, sizeof(buf));
1429+
XMEMSET(ecdsaSig, 0, sizeof(ecdsaSig));
1430+
14021431
err = RAND_bytes(buf, sizeof(buf)) == 0;
14031432
if (err == 0) {
14041433
pkey = d2i_PrivateKey(EVP_PKEY_EC, NULL, &p, sizeof(ecc_key_der_521));
@@ -1546,6 +1575,9 @@ int test_ec_key_ecdh_keygen(ENGINE *e, int nid, int len)
15461575
unsigned char secretA[66];
15471576
unsigned char secretB[66];
15481577

1578+
XMEMSET(secretA, 0, sizeof(secretA));
1579+
XMEMSET(secretB, 0, sizeof(secretB));
1580+
15491581
err = (group = EC_GROUP_new_by_curve_name(nid)) == NULL;
15501582
if (err == 0) {
15511583
err = (keyA = EC_KEY_new_method(e)) == NULL;
@@ -1667,6 +1699,9 @@ int test_ec_key_ecdh(ENGINE *e, const unsigned char *privKey, size_t len,
16671699
unsigned char secretB[66];
16681700
const unsigned char *p;
16691701

1702+
XMEMSET(secretA, 0, sizeof(secretA));
1703+
XMEMSET(secretB, 0, sizeof(secretB));
1704+
16701705
err = (keyA = EC_KEY_new_method(e)) == NULL;
16711706
if (err == 0) {
16721707
p = privKey;
@@ -1847,6 +1882,9 @@ int test_ec_key_ecdsa(ENGINE *e, const unsigned char *privKey,
18471882
unsigned char buf[20];
18481883
const unsigned char *p;
18491884

1885+
XMEMSET(buf, 0, sizeof(buf));
1886+
XMEMSET(ecdsaSig, 0, sizeof(ecdsaSig));
1887+
18501888
err = RAND_bytes(buf, sizeof(buf)) == 0;
18511889
if (err == 0) {
18521890
err = (key = EC_KEY_new_method(e)) == NULL;
@@ -2032,6 +2070,8 @@ static int test_ecdh_direct(ENGINE* e, const unsigned char* keyDer,
20322070
err = 1;
20332071
}
20342072

2073+
XMEMSET(secret, 0, sizeof(secret));
2074+
20352075
p = keyDer;
20362076
peerPrivKey = keyPeerDer;
20372077

@@ -2246,6 +2286,9 @@ static int test_ecdsa_key(ENGINE *e, const unsigned char *privKey,
22462286

22472287
PRINT_MSG("ENTER: test_ecdsa");
22482288

2289+
XMEMSET(buf, 0, sizeof(buf));
2290+
XMEMSET(ecdsaSig, 0, sizeof(ecdsaSig));
2291+
22492292
err = RAND_bytes(buf, sizeof(buf)) == 0;
22502293
if (err == 0) {
22512294
p = privKey;

‎test/test_hkdf.c‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,10 @@ static int test_hkdf_calc(ENGINE *e, unsigned char *key, int keyLen,
3535

3636
(void)mode;
3737

38+
XMEMSET(inKey, 0, sizeof(inKey));
39+
XMEMSET(salt, 0, sizeof(salt));
40+
XMEMSET(info, 0, sizeof(info));
41+
3842
ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, e);
3943
if (ctx == NULL) {
4044
err = 1;
@@ -277,6 +281,9 @@ static int test_hkdf_str_md(ENGINE *e, const char *md, const char *mode)
277281
unsigned char oKey[128];
278282
unsigned char wKey[128];
279283

284+
XMEMSET(oKey, 0, sizeof(oKey));
285+
XMEMSET(wKey, 0, sizeof(wKey));
286+
280287
PRINT_MSG("Calc with strings OpenSSL");
281288
err = test_hkdf_str_calc(NULL, oKey, sizeof(oKey), md, mode);
282289
if (err == 1) {

‎test/test_hmac.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,8 @@ int test_hmac_create(ENGINE *e, void *data)
119119
unsigned char pswd[] = "My empire of dirt";
120120
unsigned char bigPswd[100];
121121

122+
XMEMSET(bigPswd, 0, sizeof(bigPswd));
123+
122124
PRINT_MSG("Testing with SHA1");
123125
ret = test_hmac_create_helper(e, data, EVP_sha1(), pswd, sizeof(pswd));
124126
if (ret == 0) {

‎test/test_rand.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ static int test_random_api(void)
2828
int err;
2929
unsigned char buf[128];
3030

31+
XMEMSET(buf, 0, sizeof(buf));
32+
3133
err = RAND_status() != 1;
3234
#if OPENSSL_VERSION_NUMBER < 0x10100000L
3335
if (err == 0) {

‎test/test_rsa.c‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -400,6 +400,9 @@ static int test_rsa_direct(ENGINE *e, const unsigned char *der, size_t derLen,
400400
int i = 0;
401401
int rsaSize = 0;
402402

403+
XMEMSET(buf, 0, sizeof(buf));
404+
XMEMSET(testVectors, 0, sizeof(testVectors));
405+
403406
err = load_static_rsa_key(e, der, derLen, &weRsaKey, &osslRsaKey) != 1;
404407
if (err == 0) {
405408
rsaSize = RSA_size(weRsaKey);
@@ -408,14 +411,17 @@ static int test_rsa_direct(ENGINE *e, const unsigned char *der, size_t derLen,
408411
if (err == 0) {
409412
encryptedBuf = (unsigned char*)OPENSSL_zalloc(rsaSize);
410413
err = encryptedBuf == NULL;
414+
XMEMSET(encryptedBuf, 0, rsaSize);
411415
}
412416
if (err == 0) {
413417
decryptedBuf = (unsigned char*)OPENSSL_zalloc(rsaSize);
414418
err = decryptedBuf == NULL;
419+
XMEMSET(decryptedBuf, 0, rsaSize);
415420
}
416421
if (err == 0) {
417422
noPaddingBuf = (unsigned char*)OPENSSL_zalloc(rsaSize);
418423
err = noPaddingBuf == NULL;
424+
XMEMSET(noPaddingBuf, 0, rsaSize);
419425
}
420426
if (err == 0) {
421427
err = RAND_bytes(noPaddingBuf, rsaSize) == 0;
@@ -976,6 +982,8 @@ int test_rsa_sign_sha1(ENGINE *e, void *data)
976982
unsigned char buf[20];
977983
const unsigned char *p = rsa_key_der_2048;
978984

985+
XMEMSET(buf, 0, sizeof(buf));
986+
979987
PRINT_MSG("Load RSA key");
980988
pkey = d2i_PrivateKey(EVP_PKEY_RSA, NULL, &p, sizeof(rsa_key_der_2048));
981989
err = pkey == NULL;
@@ -1102,6 +1110,7 @@ static int test_rsa_enc_dec(ENGINE *e, const unsigned char *der, size_t derLen,
11021110
}
11031111
buf = (unsigned char *)OPENSSL_zalloc(bufLen);
11041112
err = buf == NULL;
1113+
XMEMSET(buf, 0, bufLen);
11051114
}
11061115
if (err == 0) {
11071116
err = RAND_bytes(buf, (int)bufLen) == 0;
@@ -1310,6 +1319,8 @@ int test_rsa_pkey_invalid_key_size(ENGINE *e, void *data) {
13101319
(void)rsa_key_der_256;
13111320
(void)rsa_key_der_1024;
13121321

1322+
XMEMSET(buf, 0, sizeof(buf));
1323+
13131324
pkey = d2i_PrivateKey(EVP_PKEY_RSA, NULL, &p, (long)pSize);
13141325
err = pkey == NULL;
13151326
if (err == 0) {

0 commit comments

Comments
 (0)