Skip to content

Commit 21c6568

Browse files
douzzerdouzzer
committed
Fixes for -Wcast-qual hygiene in wolfCrypt.
.github/workflows/wolfCrypt-Wconversion.yml: Add -Wcast-qual to all scenarios. wolfssl/wolfcrypt/signature.h, wolfcrypt/src/signature.c, doc/dox_comments/header_files/signature.h: Remove incorrect const qualifier on the key argument in * wc_SignatureVerifyHash() * wc_SignatureVerify() * wc_SignatureGenerateHash() * wc_SignatureGenerateHash_ex() * wc_SignatureGenerate() * wc_SignatureGenerate_ex() This fixes UB code patterns throughout signature.c. key is inherently accessed readwrite by the underlying low level crypto. Fortunately, wolfCrypt has no APIs/methods to allow actual const MPI key objects, therefore these seeming breaking API changes can't actually break any users. globally: * Add const qualifiers to all struct pointer members that are assigned values computed from const pointers. * Add const qualifiers to intermediate casts for accessors and read-only dereference constructs, as needed for -Wcast-qual hygiene, e.g. for a macro GET_U16(a), use (*(const word16*)(a)) rather than (*(word16*)(a)). * Add const qualifiers to internal declarations, and remove illegal casts, as needed for -Wcast-qual hygiene. * Add missing const qualifiers to all casts for argument, operand, and assignment type agreement, as needed for -Wcast-qual hygiene, e.g. "*data = (const byte*)dataASN->data.ref.data" rather than "*data = (byte*)dataASN->data.ref.data". wolfssl/wolfcrypt/asn.h, wolfssl/wolfcrypt/asn_public.h, wolfcrypt/src/asn.c, wolfcrypt/src/asn_orig.c: * Add additional lifecycle management for object members that are only sometimes locally allocated: DNS_entry.nameStored DNS_entry.ipStringStored DNS_entry.ridStringStored wolfssl/wolfcrypt/types.h: add WC_BARRIER() macro -- a portable construct that prevents compiler optimizers from reordering operations across the barrier. wolfssl/wolfcrypt/blake2-impl.h, wolfcrypt/src/blake2s.c, wolfcrypt/src/blake2b.c: * In blake2b_init(), blake2b_init_key(), blake2s_init(), and blake2s_init_key(), refactor blake2b_param initialization using WC_BARRIER() (fixes volatile abuse that triggered -Wcast-qual). * Remove the residual and unused WOLFSSL_BLAKE2[BS]_INIT_EACH_FIELD code. wolfcrypt/src/ecc.c and wolfssl/wolfcrypt/ecc.h: Remove incorrect const qualifier on curve arg to wc_ecc_free_curve() (internal function).
1 parent 6fc93ac commit 21c6568

36 files changed

Lines changed: 527 additions & 417 deletions

‎.github/workflows/wolfCrypt-Wconversion.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,17 @@ jobs:
1818
matrix:
1919
config: [
2020
# Add new configs here
21-
'--disable-asm --enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem CPPFLAGS="-Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion"',
22-
'--enable-intelasm --enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem CPPFLAGS="-Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion"',
23-
'--enable-smallstack --disable-asm --enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem CPPFLAGS="-Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion"',
24-
'--enable-smallstack --enable-intelasm --enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem CPPFLAGS="-Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion"',
25-
'--enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem CPPFLAGS="-Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion -DNO_INT128"',
26-
'--enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem CPPFLAGS="-Wdeclaration-after-statement -Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion" --enable-32bit CFLAGS=-m32',
27-
'--enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem=yes,small CPPFLAGS="-Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion -DNO_INT128"',
28-
'--enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem=yes,no-large-code CPPFLAGS="-Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion -DNO_INT128"',
29-
'--enable-smallstack --enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem CPPFLAGS="-Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion -DNO_INT128"',
30-
'--disable-intelasm --enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem CPPFLAGS="-DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -Wdeclaration-after-statement -Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion" --enable-32bit CFLAGS=-m32',
31-
'--disable-intelasm --enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem=yes,small CPPFLAGS="-DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion -DNO_INT128"',
21+
'--disable-asm --enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem CPPFLAGS="-Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion -Wcast-qual"',
22+
'--enable-intelasm --enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem CPPFLAGS="-Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion -Wcast-qual"',
23+
'--enable-smallstack --disable-asm --enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem CPPFLAGS="-Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion -Wcast-qual"',
24+
'--enable-smallstack --enable-intelasm --enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem CPPFLAGS="-Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion -Wcast-qual"',
25+
'--enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem CPPFLAGS="-Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion -DNO_INT128 -Wcast-qual"',
26+
'--enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem CPPFLAGS="-Wdeclaration-after-statement -Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion -Wcast-qual" --enable-32bit CFLAGS=-m32',
27+
'--enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem=yes,small CPPFLAGS="-Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion -Wcast-qual -DNO_INT128"',
28+
'--enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem=yes,no-large-code CPPFLAGS="-Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion -Wcast-qual -DNO_INT128"',
29+
'--enable-smallstack --enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem CPPFLAGS="-Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion -Wcast-qual -DNO_INT128"',
30+
'--disable-intelasm --enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem CPPFLAGS="-DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -Wdeclaration-after-statement -Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion -Wcast-qual" --enable-32bit CFLAGS=-m32',
31+
'--disable-intelasm --enable-cryptonly --enable-all-crypto --disable-examples --disable-benchmark --disable-crypttests --enable-mlkem=yes,small CPPFLAGS="-DWOLFSSL_MLKEM_ENCAPSULATE_SMALL_MEM -DWOLFSSL_MLKEM_MAKEKEY_SMALL_MEM -Wconversion -Warith-conversion -Wenum-conversion -Wfloat-conversion -Wsign-conversion -Wcast-qual -DNO_INT128"',
3232
]
3333
name: build library
3434
if: github.repository_owner == 'wolfssl'

‎.wolfssl_known_macro_extras‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -705,8 +705,6 @@ WOLFSSL_ATMEL_TIME
705705
WOLFSSL_BEFORE_DATE_CLOCK_SKEW
706706
WOLFSSL_BIGINT_TYPES
707707
WOLFSSL_BIO_NO_FLOW_STATS
708-
WOLFSSL_BLAKE2B_INIT_EACH_FIELD
709-
WOLFSSL_BLAKE2S_INIT_EACH_FIELD
710708
WOLFSSL_BYTESWAP32_ASM
711709
WOLFSSL_CAAM_BLACK_KEY_AESCCM
712710
WOLFSSL_CAAM_BLACK_KEY_SM

‎doc/dox_comments/header_files/signature.h‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ int wc_SignatureVerify(
8080
enum wc_HashType hash_type, enum wc_SignatureType sig_type,
8181
const byte* data, word32 data_len,
8282
const byte* sig, word32 sig_len,
83-
const void* key, word32 key_len);
83+
void* key, word32 key_len);
8484

8585
/*!
8686
\ingroup Signature
@@ -143,7 +143,7 @@ int wc_SignatureGenerate(
143143
enum wc_HashType hash_type, enum wc_SignatureType sig_type,
144144
const byte* data, word32 data_len,
145145
byte* sig, word32 *sig_len,
146-
const void* key, word32 key_len,
146+
void* key, word32 key_len,
147147
WC_RNG* rng);
148148

149149
/*!
@@ -194,7 +194,7 @@ int wc_SignatureVerifyHash(enum wc_HashType hash_type,
194194
enum wc_SignatureType sig_type,
195195
const byte* hash_data, word32 hash_len,
196196
const byte* sig, word32 sig_len,
197-
const void* key, word32 key_len);
197+
void* key, word32 key_len);
198198

199199
/*!
200200
\ingroup Signature
@@ -245,7 +245,7 @@ int wc_SignatureGenerateHash(enum wc_HashType hash_type,
245245
enum wc_SignatureType sig_type,
246246
const byte* hash_data, word32 hash_len,
247247
byte* sig, word32 *sig_len,
248-
const void* key, word32 key_len,
248+
void* key, word32 key_len,
249249
WC_RNG* rng);
250250

251251
/*!
@@ -296,7 +296,7 @@ int wc_SignatureGenerateHash_ex(enum wc_HashType hash_type,
296296
enum wc_SignatureType sig_type,
297297
const byte* hash_data, word32 hash_len,
298298
byte* sig, word32 *sig_len,
299-
const void* key, word32 key_len,
299+
void* key, word32 key_len,
300300
WC_RNG* rng, int verify);
301301

302302
/*!
@@ -346,5 +346,5 @@ int wc_SignatureGenerate_ex(enum wc_HashType hash_type,
346346
enum wc_SignatureType sig_type,
347347
const byte* data, word32 data_len,
348348
byte* sig, word32 *sig_len,
349-
const void* key, word32 key_len,
349+
void* key, word32 key_len,
350350
WC_RNG* rng, int verify);

‎src/internal.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13384,7 +13384,7 @@ int CheckForAltNames(DecodedCert* dCert, const char* domain, word32 domainLen,
1338413384
{
1338513385
int match = 0;
1338613386
DNS_entry* altName = NULL;
13387-
char *buf;
13387+
const char *buf;
1338813388
word32 len;
1338913389

1339013390
WOLFSSL_MSG("Checking AltNames");

‎src/ocsp.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2131,8 +2131,8 @@ int wolfSSL_OCSP_request_add1_nonce(OcspRequest* req, unsigned char* val,
21312131
*/
21322132
int wolfSSL_OCSP_check_nonce(OcspRequest* req, WOLFSSL_OCSP_BASICRESP* bs)
21332133
{
2134-
byte* reqNonce = NULL;
2135-
byte* rspNonce = NULL;
2134+
const byte* reqNonce = NULL;
2135+
const byte* rspNonce = NULL;
21362136
int reqNonceSz = 0;
21372137
int rspNonceSz = 0;
21382138

‎src/ssl_certman.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1265,7 +1265,9 @@ static WC_INLINE int cm_restore_cert_row(WOLFSSL_CERT_MANAGER* cm,
12651265

12661266
if (ret == 0) {
12671267
/* Copy in certificate name. */
1268-
XMEMCPY(signer->name, current + idx, (size_t)signer->nameLen);
1268+
/* safe cast -- allocated by above XMALLOC(). */
1269+
XMEMCPY((void *)(wc_ptr_t)signer->name, current + idx,
1270+
(size_t)signer->nameLen);
12691271
idx += signer->nameLen;
12701272

12711273
/* Copy in hash of subject name. */

‎src/x509.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3061,6 +3061,7 @@ int wolfSSL_X509_add_altname_ex(WOLFSSL_X509* x509, const char* name,
30613061
newAltName->type = type;
30623062
newAltName->len = (int)nameSz;
30633063
newAltName->name = nameCopy;
3064+
newAltName->nameStored = 1;
30643065
x509->altNames = newAltName;
30653066

30663067
return WOLFSSL_SUCCESS;
@@ -4259,7 +4260,8 @@ char* wolfSSL_X509_get_next_altname(WOLFSSL_X509* cert)
42594260
return NULL;
42604261
}
42614262

4262-
ret = cert->altNamesNext->name;
4263+
/* unsafe cast required for ABI compatibility. */
4264+
ret = (char *)(wc_ptr_t)cert->altNamesNext->name;
42634265
#ifdef WOLFSSL_IP_ALT_NAME
42644266
/* return the IP address as a string */
42654267
if (cert->altNamesNext->type == ASN_IP_TYPE) {

‎tests/api/test_ocsp.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -251,7 +251,7 @@ int test_ocsp_basic_verify(void)
251251
WOLFSSL_SUCCESS);
252252
/* verify that the signature is checked */
253253
if (EXPECT_SUCCESS()) {
254-
response->sig[0] ^= 0xff;
254+
((byte *)(wc_ptr_t)response->sig)[0] ^= 0xff;
255255
}
256256
ExpectIntEQ(wolfSSL_OCSP_basic_verify(response, NULL, NULL, OCSP_NOVERIFY),
257257
WOLFSSL_FAILURE);
@@ -285,12 +285,12 @@ int test_ocsp_basic_verify(void)
285285
WOLFSSL_SUCCESS);
286286
/* make invalid signature */
287287
if (EXPECT_SUCCESS()) {
288-
response->sig[0] ^= 0xff;
288+
((byte *)(wc_ptr_t)response->sig)[0] ^= 0xff;
289289
}
290290
ExpectIntEQ(wolfSSL_OCSP_basic_verify(response, NULL, store, 0),
291291
WOLFSSL_FAILURE);
292292
if (EXPECT_SUCCESS()) {
293-
response->sig[0] ^= 0xff;
293+
((byte *)(wc_ptr_t)response->sig)[0] ^= 0xff;
294294
}
295295

296296
/* cert embedded and in certs, no store needed bc OCSP_TRUSTOTHER */

0 commit comments

Comments
 (0)