Fix various issues

CMakeLists.txt

@@ -101,6 +101,7 @@ check_include_file("time.h" HAVE_TIME_H)
 check_include_file("sys/ioctl.h" HAVE_SYS_IOCTL_H)
 check_include_file("sys/socket.h" HAVE_SYS_SOCKET_H)
 check_include_file("sys/time.h" HAVE_SYS_TIME_H)
+check_include_file("sys/un.h" HAVE_SYS_UN_H)
 check_include_file("errno.h" HAVE_ERRNO_H)
 check_include_file("dlfcn.h" HAVE_DLFCN_H)
 check_include_file("inttypes.h" HAVE_INTTYPES_H)
@@ -113,13 +114,21 @@ check_include_file("sys/stat.h" HAVE_SYS_STAT_H)
 check_include_file("sys/types.h" HAVE_SYS_TYPES_H)
 check_include_file("unistd.h" HAVE_UNISTD_H)
 
-# types.h depends on HAVE_LIMITS_H, and it is defined in options.h (rather than
-# config.h) so that applications consuming wolfSSL headers see it. The in-tree
-# build, however, is configured through config.h/compile definitions and does
-# not include options.h, so define it here as well.
+# types.h depends on HAVE_LIMITS_H, and callbacks.h sizes WOLFSSL_TIMEVAL with
+# HAVE_SYS_TIME_H. Both are defined in options.h (rather than config.h) so that
+# applications consuming wolfSSL headers see the same value the library was
+# built with. The in-tree build, however, is configured through
+# config.h/compile definitions and does not include options.h, so define them
+# here as well.
 if(HAVE_LIMITS_H)
     add_definitions("-DHAVE_LIMITS_H")
 endif()
+if(HAVE_SYS_TIME_H)
+    add_definitions("-DHAVE_SYS_TIME_H")
+endif()
+if(HAVE_SYS_UN_H)
+    add_definitions("-DHAVE_SYS_UN_H")
+endif()
 
 include(CheckFunctionExists)
 

cmake/config.in

@@ -34,9 +34,6 @@
 /* Define to 1 if you have the <string.h> header file. */
 #cmakedefine HAVE_STRING_H @HAVE_STRING_H@
 
-/* Define to 1 if you have the <sys/time.h> header file. */
-#cmakedefine HAVE_SYS_TIME_H @HAVE_SYS_TIME_H@
-
 /* Define to 1 if you have the <Security/SecTrustSettings.h> header file. */
 #cmakedefine HAVE_SECURITY_SECTRUSTSETTINGS_H @HAVE_SECURITY_SECTRUSTSETTINGS_H@
 

cmake/options.h.in

@@ -41,6 +41,12 @@ extern "C" {
 /* Since types.h depends on HAVE_LIMITS_H, we must define it in options.h. */
 #undef HAVE_LIMITS_H
 #cmakedefine HAVE_LIMITS_H @HAVE_LIMITS_H@
+/* callbacks.h sizes WOLFSSL_TIMEVAL with HAVE_SYS_TIME_H, so it must be in
+ * options.h too. */
+#undef HAVE_SYS_TIME_H
+#cmakedefine HAVE_SYS_TIME_H @HAVE_SYS_TIME_H@
+#undef HAVE_SYS_UN_H
+#cmakedefine HAVE_SYS_UN_H @HAVE_SYS_UN_H@
 #undef ASIO_USE_WOLFSSL
 #cmakedefine ASIO_USE_WOLFSSL
 #undef BOOST_ASIO_USE_WOLFSSL

configure.ac

@@ -221,9 +221,14 @@ then
     fi
 fi
 
-AC_CHECK_HEADERS([arpa/inet.h fcntl.h netdb.h netinet/in.h stddef.h time.h sys/ioctl.h sys/socket.h sys/time.h errno.h sys/un.h ctype.h sys/random.h])
+AC_CHECK_HEADERS([arpa/inet.h fcntl.h netdb.h netinet/in.h stddef.h time.h sys/ioctl.h sys/socket.h errno.h ctype.h sys/random.h])
 # Special case: Since types.h depends on HAVE_LIMITS_H, we must define it in options.h.
 AC_CHECK_HEADER([limits.h], [AM_CPPFLAGS="$AM_CPPFLAGS -DHAVE_LIMITS_H=1"], [])
+# Special case: these gate the layout of public types in installed headers
+# (union WOLFSSL_BIO_ADDR in wolfio.h, WOLFSSL_TIMEVAL in callbacks.h), so
+# applications must see the same value the library was built with.
+AC_CHECK_HEADER([sys/un.h], [AM_CPPFLAGS="$AM_CPPFLAGS -DHAVE_SYS_UN_H=1"], [])
+AC_CHECK_HEADER([sys/time.h], [AM_CPPFLAGS="$AM_CPPFLAGS -DHAVE_SYS_TIME_H=1"], [])
 AC_CHECK_LIB([network],[socket])
 AC_C_BIGENDIAN
 AC_C___ATOMIC

src/internal.c

@@ -14198,11 +14198,11 @@ int CheckHostName(DecodedCert* dCert, const char *domainName,
     return ret;
 }
 
-int CheckIPAddr(DecodedCert* dCert, const char* ipasc)
+int CheckIPAddr(DecodedCert* dCert, const char* ipasc, size_t ipascLen)
 {
     WOLFSSL_MSG("Checking IPAddr");
 
-    return CheckHostName(dCert, ipasc, (size_t)XSTRLEN(ipasc), 0, 1);
+    return CheckHostName(dCert, ipasc, ipascLen, 0, 1);
 }
 
 
@@ -15646,7 +15646,8 @@ int DoVerifyCallback(WOLFSSL_CERT_MANAGER* cm, WOLFSSL* ssl, int cert_err,
         /* perform IP address check on the peer certificate */
         if ((args->dCertInit != 0) && (args->dCert != NULL) && (ssl != NULL) &&
             (ssl->param != NULL) && (XSTRLEN(ssl->param->ipasc) > 0)) {
-            if (CheckIPAddr(args->dCert, ssl->param->ipasc) != 0) {
+            if (CheckIPAddr(args->dCert, ssl->param->ipasc,
+                            (size_t)XSTRLEN(ssl->param->ipasc)) != 0) {
                 if (cert_err == 0) {
                     ret = IPADDR_MISMATCH;
                     WOLFSSL_ERROR_VERBOSE(ret);
@@ -18371,7 +18372,8 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
 #ifndef OPENSSL_EXTRA
                 if (!ssl->options.verifyNone && ssl->buffers.ipasc.buffer) {
                     if (CheckIPAddr(args->dCert,
-                            (const char*)ssl->buffers.ipasc.buffer) != 0) {
+                            (const char*)ssl->buffers.ipasc.buffer,
+                            (size_t)ssl->buffers.ipasc.length) != 0) {
                         WOLFSSL_MSG("IPAddr match on alt names failed");
                         ret = IPADDR_MISMATCH;
                         WOLFSSL_ERROR_VERBOSE(ret);

src/x509.c

@@ -15795,7 +15795,7 @@ int wolfSSL_X509_check_ip_asc(WOLFSSL_X509 *x, const char *ipasc,
             ret = WOLFSSL_FAILURE;
         }
         else {
-            ret = CheckIPAddr(dCert, ipasc);
+            ret = CheckIPAddr(dCert, ipasc, (size_t)XSTRLEN(ipasc));
             if (ret != 0) {
                 ret = WOLFSSL_FAILURE;
             }

tests/api/test_ossl_x509.c

@@ -422,6 +422,20 @@ int test_wolfSSL_X509_check_host(void)
     ExpectIntEQ(wolfSSL_X509_check_host(x509, altName, XSTRLEN(altName),
         WOLFSSL_MULTI_LABEL_WILDCARDS, NULL), WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 
+    /* chk of exactly chklen bytes with no terminator - every consumer must
+     * stay within the caller's declared length. */
+    {
+        char* bounded = (char*)XMALLOC(XSTRLEN(altName), NULL,
+                                       DYNAMIC_TYPE_TMP_BUFFER);
+        ExpectNotNull(bounded);
+        if (bounded != NULL) {
+            XMEMCPY(bounded, altName, XSTRLEN(altName));
+            ExpectIntEQ(X509_check_host(x509, bounded, XSTRLEN(altName), 0,
+                    NULL), WOLFSSL_SUCCESS);
+            XFREE(bounded, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        }
+    }
+
     X509_free(x509);
 
     ExpectIntEQ(X509_check_host(NULL, altName, XSTRLEN(altName), 0, NULL),

tests/api/test_pkcs7.c

@@ -6656,18 +6656,11 @@ int test_wc_PKCS7_VerifySignedData_TruncEContentTag(void)
  * SignedData bundle truncated at the certificates [0] IMPLICIT tag.
  * Verifies that the parser rejects the malformed input rather than
  * dereferencing past the end of the buffer.
- *
- * TODO: limited to NO_PKCS7_STREAM because the streaming parser's stage 3
- * early-exit check (pkcs7.c near line 6594) accepts any bundle
- * whose remaining footer is < 6 bytes as a successful degenerate end,
- * so the bounds check at line 6765 is unreachable in streaming mode.
- * Drop the NO_PKCS7_STREAM gate if/when the early-exit check becomes
- * more accurate.
  */
 int test_wc_PKCS7_VerifySignedData_TruncCertSetTag(void)
 {
     EXPECT_DECLS;
-#if defined(HAVE_PKCS7) && defined(NO_PKCS7_STREAM)
+#if defined(HAVE_PKCS7)
     PKCS7* pkcs7 = NULL;
 
     WOLFSSL_SMALL_STACK_STATIC byte der[] = {
@@ -6707,7 +6700,71 @@ int test_wc_PKCS7_VerifySignedData_TruncCertSetTag(void)
     ExpectIntNE(wc_PKCS7_VerifySignedData(pkcs7, der, derSz), 0);
     wc_PKCS7_Free(pkcs7);
 
-#endif /* HAVE_PKCS7 && NO_PKCS7_STREAM */
+#endif /* HAVE_PKCS7 */
+    return EXPECT_RESULT();
+}
+
+/*
+ * SignedData bundle with a non-empty digestAlgorithms SET whose signerInfos
+ * field is absent entirely - the bundle stops right after the eContent.
+ * signerInfos is a required field, so the bundle must be rejected both with
+ * the default settings and with wc_PKCS7_AllowDegenerate() turned off.
+ */
+int test_wc_PKCS7_VerifySignedData_NoSignerInfos(void)
+{
+    EXPECT_DECLS;
+#if defined(HAVE_PKCS7) && !defined(NO_SHA256)
+    PKCS7* pkcs7 = NULL;
+
+    WOLFSSL_SMALL_STACK_STATIC byte der[] = {
+        /* outer ContentInfo SEQUENCE (99 bytes content) */
+        0x30, 0x63,
+        /* contentType OID signedData */
+        0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, 0x02,
+        /* [0] EXPLICIT (86 bytes content) */
+        0xA0, 0x56,
+        /* SignedData SEQUENCE (84 bytes content) */
+        0x30, 0x54,
+        /* version INTEGER 1 */
+        0x02, 0x01, 0x01,
+        /* digestAlgorithms SET (15 bytes) { sha256 AlgorithmIdentifier } */
+        0x31, 0x0F,
+        0x30, 0x0D,
+        0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
+        0x05, 0x00,
+        /* encapContentInfo SEQUENCE (62 bytes content) */
+        0x30, 0x3E,
+        /* eContentType OID 1.2.840.113549.1.7.1 (data) */
+        0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, 0x01,
+        /* eContent [0] EXPLICIT (49 bytes content) */
+        0xA0, 0x31,
+        /* OCTET STRING (47 bytes content) */
+        0x04, 0x2F,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41
+        /* no certificates, no signerInfos: bundle ends here */
+    };
+    word32 derSz = (word32)sizeof(der);
+
+    ExpectNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, testDevId));
+    ExpectIntEQ(wc_PKCS7_Init(pkcs7, HEAP_HINT, INVALID_DEVID), 0);
+    ExpectIntEQ(wc_PKCS7_InitWithCert(pkcs7, NULL, 0), 0);
+    ExpectIntNE(wc_PKCS7_VerifySignedData(pkcs7, der, derSz), 0);
+    wc_PKCS7_Free(pkcs7);
+    pkcs7 = NULL;
+
+    ExpectNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, testDevId));
+    ExpectIntEQ(wc_PKCS7_Init(pkcs7, HEAP_HINT, INVALID_DEVID), 0);
+    ExpectIntEQ(wc_PKCS7_InitWithCert(pkcs7, NULL, 0), 0);
+    wc_PKCS7_AllowDegenerate(pkcs7, 0);
+    ExpectIntNE(wc_PKCS7_VerifySignedData(pkcs7, der, derSz), 0);
+    wc_PKCS7_Free(pkcs7);
+
+#endif /* HAVE_PKCS7 && !NO_SHA256 */
     return EXPECT_RESULT();
 }
 

tests/api/test_pkcs7.h

@@ -80,6 +80,7 @@ int test_wc_PKCS7_VerifySignedData_PKCS7ContentSeq(void);
 int test_wc_PKCS7_VerifySignedData_IndefLenOOB(void);
 int test_wc_PKCS7_VerifySignedData_TruncEContentTag(void);
 int test_wc_PKCS7_VerifySignedData_TruncCertSetTag(void);
+int test_wc_PKCS7_VerifySignedData_NoSignerInfos(void);
 int test_wc_PKCS7_VerifySignedData_NoDigestParams(void);
 
 
@@ -137,6 +138,7 @@ int test_wc_PKCS7_VerifySignedData_NoDigestParams(void);
     TEST_DECL_GROUP("pkcs7_sd", test_wc_PKCS7_VerifySignedData_IndefLenOOB), \
     TEST_DECL_GROUP("pkcs7_sd", test_wc_PKCS7_VerifySignedData_TruncEContentTag), \
     TEST_DECL_GROUP("pkcs7_sd", test_wc_PKCS7_VerifySignedData_TruncCertSetTag), \
+    TEST_DECL_GROUP("pkcs7_sd", test_wc_PKCS7_VerifySignedData_NoSignerInfos), \
     TEST_DECL_GROUP("pkcs7_sd", test_wc_PKCS7_VerifySignedData_NoDigestParams)
 
 #define TEST_PKCS7_ENCRYPTED_DATA_DECLS                                     \

wolfcrypt/src/ecc.c

@@ -9593,6 +9593,11 @@ static int ecc_verify_hash(mp_int *r, mp_int *s, const byte* hash,
         u1 = u1tmp;
         u2 = u2tmp;
     #endif
+       /* zeroed so the cleanup below no-ops if the init is skipped */
+       if (u1 != NULL)
+           XMEMSET(u1, 0, sizeof(mp_int));
+       if (u2 != NULL)
+           XMEMSET(u2, 0, sizeof(mp_int));
 #else
        u1 = e;
        u2 = w;
@@ -14042,18 +14047,23 @@ static int accel_fp_mul2add(int idx1, int idx2,
    int first;
 
 #ifdef WOLFSSL_SMALL_STACK
+   /* each is zeroed on acquisition so the cleanup below no-ops if a later
+    * allocation fails and the init is skipped */
    tka = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
    if (tka == NULL) {
       err = MEMORY_E; goto done;
    }
+   XMEMSET(tka, 0, sizeof(mp_int));
    tkb = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
    if (tkb == NULL) {
       err = MEMORY_E; goto done;
    }
+   XMEMSET(tkb, 0, sizeof(mp_int));
    order = (mp_int*)XMALLOC(sizeof(mp_int), NULL, DYNAMIC_TYPE_ECC);
    if (order == NULL) {
       err = MEMORY_E; goto done;
    }
+   XMEMSET(order, 0, sizeof(mp_int));
 #endif
 
    if (mp_init_multi(tka, tkb, order, NULL, NULL, NULL) != MP_OKAY) {

wolfcrypt/src/pkcs7.c

@@ -7510,26 +7510,31 @@ static int PKCS7_VerifySignedData(wc_PKCS7* pkcs7, const byte* hashBuf,
                 pkcs7->content   = pkcs7->contentDynamic;
             }
 
-            /* check if bundle has more elements or footer, if not, set content
-             * to pkcs7->content and hash to pkcs7->hash.
+            /* expect data length to be enough to check set and seq of certs,
+             * but never more than what is left inside the outer ContentInfo,
+             * so that a short footer (such as an empty signerInfos SET "31 00"
+             * with no certificates) is still parsed by the stages below rather
+             * than stalling on a window the bundle cannot fill.
              *
-             * NOTE: this check returns success whenever fewer than 6 bytes
-             * follow the content within the outer ContentInfo, which also
-             * accepts truncated bundles whose footer was cut short (e.g. a
-             * lone certificates [0] tag with no length). Distinguishing a
-             * legitimate degenerate end (such as an empty signerInfos SET
-             * "31 00") from truncated junk would require peeking at the
-             * remaining bytes or making stage 4's `expected` window smaller.
-             */
-            if (ret == 0 && pkcs7->stream->maxLen > 0 &&
-                    (pkcs7->stream->maxLen - pkcs7->stream->totalRd)
-                                                < ASN_TAG_SZ + MAX_LENGTH_SZ) {
+             * maxLen only bounds the bundle when it was taken from a complete
+             * outer SEQUENCE header; a caller feeding small chunks can leave
+             * it behind totalRd, so leave the window uncapped in that case
+             * rather than subtracting past zero. */
+            pkcs7->stream->expected = (ASN_TAG_SZ + MAX_LENGTH_SZ) * 2;
+            if (pkcs7->stream->maxLen > 0 &&
+                    pkcs7->stream->maxLen >= pkcs7->stream->totalRd) {
+                if (pkcs7->stream->expected > (pkcs7->stream->maxLen -
+                                pkcs7->stream->totalRd) + pkcs7->stream->length)
+                    pkcs7->stream->expected = (pkcs7->stream->maxLen -
+                                pkcs7->stream->totalRd) + pkcs7->stream->length;
 
-                ret = 0;
-                break;
+                /* signerInfos is a required field of SignedData */
+                if (pkcs7->stream->expected == 0) {
+                    WOLFSSL_MSG("PKCS7 bundle ends before signerInfos");
+                    ret = PKCS7_NO_SIGNER_E;
+                    break;
+                }
             }
-            /* expect data length to be enough to check set and seq of certs */
-            pkcs7->stream->expected = (ASN_TAG_SZ + MAX_LENGTH_SZ) * 2;
 
         #else
             /* Break out before content because it can be optional in degenerate

wolfcrypt/src/rsa.c

@@ -5077,6 +5077,12 @@ static int wc_CompareDiffPQ(mp_int* p, mp_int* q, int size, int* valid)
     else
         ret = 0;
 
+    /* zeroed so the cleanup below no-ops if the init is skipped */
+    if (c != NULL)
+        XMEMSET(c, 0, sizeof(*c));
+    if (d != NULL)
+        XMEMSET(d, 0, sizeof(*d));
+
     if (ret == 0)
 #endif
         ret = mp_init_multi(c, d, NULL, NULL, NULL, NULL);
@@ -5343,6 +5349,15 @@ int wc_CheckProbablePrime_ex(const byte* pRaw, word32 pRawSz,
     }
     else
         ret = 0;
+
+    /* zeroed so the cleanup below no-ops if the init is skipped */
+    if (p != NULL)
+        XMEMSET(p, 0, sizeof(*p));
+    if (q != NULL)
+        XMEMSET(q, 0, sizeof(*q));
+    if (e != NULL)
+        XMEMSET(e, 0, sizeof(*e));
+
     if (ret == 0)
 #endif
         ret = mp_init_multi(p, q, e, NULL, NULL, NULL);

wolfcrypt/src/sakke.c

@@ -2082,6 +2082,16 @@ static int sakke_accumulate_line_add_one(mp_proj* v, mp_int* prime, mp_digit mp,
     t3 = (mp_int *)XMALLOC(sizeof(*t3), NULL, DYNAMIC_TYPE_TMP_BUFFER);
     if (t3 == NULL)
         err = 1;
+
+    /* zeroed so the cleanup below no-ops if the init is skipped */
+    if (h != NULL)
+        XMEMSET(h, 0, sizeof(*h));
+    if (ty != NULL)
+        XMEMSET(ty, 0, sizeof(*ty));
+    if (tz != NULL)
+        XMEMSET(tz, 0, sizeof(*tz));
+    if (t3 != NULL)
+        XMEMSET(t3, 0, sizeof(*t3));
 #else
     mp_int tmp[4];
     mp_int* h = &tmp[0];