Repository navigation
Conversation
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #298
Scan targets checked: wolfcrypt-jni-src, wolfcrypt-jni-bugs
Coverage: 10 of 32 in-scope changed file(s) opened by the reviewer; not opened: jni/include/com_wolfssl_wolfcrypt_Md5.h, jni/include/com_wolfssl_wolfcrypt_Sha.h, jni/include/com_wolfssl_wolfcrypt_Sha224.h, jni/include/com_wolfssl_wolfcrypt_Sha256.h, jni/include/com_wolfssl_wolfcrypt_Sha3.h, jni/include/com_wolfssl_wolfcrypt_Sha384.h, jni/include/com_wolfssl_wolfcrypt_Sha512.h, jni/jni_sha.c, src/main/java/com/wolfssl/wolfcrypt/Sha.java, src/main/java/com/wolfssl/wolfcrypt/Sha224.java and 12 more
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Review tier: Lite
|
|
||
| if (md5 != NULL) { | ||
| wc_Md5Free(md5); | ||
| XMEMSET(md5, 0, sizeof(Md5)); |
There was a problem hiding this comment.
Claude: native_free_internal() zeroes the freed digest struct with plain XMEMSET instead of wc_ForceZero. The same pattern occurs at jni_sha.c:91,115,142,167,192,1883.
Did we want to match the pattern in jni_chacha.c, jni_aescts.c, jni_aesxts.c, jni_hmac.c?
…geDigest.native_free()
…so the modulus bits set the salt length
…keep the pending exception
This PR fixes 5 Fenrir issues:
wc_DhAgree()shared secret buffer to fit the key's prime.MessageDigest.native_free().AesCmacafterdoFinal(), sincewc_CmacFinal()frees the native context.wc_RsaPSS_VerifyCheck()so the salt length follows the modulus bits.GetByteArrayElements()failure and keep the pending exception.