Skip to content

Commit 58885b0

Browse files
embhornembhorn
committed
Fixes from review
1 parent 2a801ea commit 58885b0

2 files changed

Lines changed: 76 additions & 71 deletions

File tree

‎src/tls13.c‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2638,9 +2638,10 @@ static int EncryptTls13(WOLFSSL* ssl, byte* output, const byte* input,
26382638
#endif
26392639

26402640
#ifdef WOLFSSL_CIPHER_TEXT_CHECK
2641-
if (ssl->specs.bulk_cipher_algorithm != wolfssl_cipher_null) {
2641+
if (ssl->specs.bulk_cipher_algorithm != wolfssl_cipher_null &&
2642+
dataSz >= WOLFSSL_CIPHER_CHECK_SZ) {
26422643
XMEMCPY(ssl->encrypt.sanityCheck, input,
2643-
min(dataSz, sizeof(ssl->encrypt.sanityCheck)));
2644+
sizeof(ssl->encrypt.sanityCheck));
26442645
}
26452646
#endif
26462647

@@ -2824,8 +2825,9 @@ static int EncryptTls13(WOLFSSL* ssl, byte* output, const byte* input,
28242825

28252826
#ifdef WOLFSSL_CIPHER_TEXT_CHECK
28262827
if (ssl->specs.bulk_cipher_algorithm != wolfssl_cipher_null &&
2828+
dataSz >= WOLFSSL_CIPHER_CHECK_SZ &&
28272829
XMEMCMP(output, ssl->encrypt.sanityCheck,
2828-
min(dataSz, sizeof(ssl->encrypt.sanityCheck))) == 0) {
2830+
sizeof(ssl->encrypt.sanityCheck)) == 0) {
28292831

28302832
WOLFSSL_MSG("EncryptTls13 sanity check failed! Glitch?");
28312833
return ENCRYPT_ERROR;

‎tests/api/test_tls13.c‎

Lines changed: 71 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -2927,28 +2927,28 @@ int test_tls13_duplicate_extension(void)
29272927
(!defined(NO_RSA) || defined(HAVE_ECC))
29282928
static int DupEchSend(WOLFSSL* ssl, char* buf, int sz, void* ctx)
29292929
{
2930-
(void)ssl;
2931-
(void)buf;
2932-
(void)sz;
2933-
(void)ctx;
2930+
(void)ssl;
2931+
(void)buf;
2932+
(void)sz;
2933+
(void)ctx;
29342934

2935-
return sz;
2935+
return sz;
29362936
}
29372937
static int DupEchRecv(WOLFSSL* ssl, char* buf, int sz, void* ctx)
29382938
{
2939-
WOLFSSL_BUFFER_INFO* msg = (WOLFSSL_BUFFER_INFO*)ctx;
2940-
int len = (int)msg->length;
2939+
WOLFSSL_BUFFER_INFO* msg = (WOLFSSL_BUFFER_INFO*)ctx;
2940+
int len = (int)msg->length;
29412941

2942-
(void)ssl;
2943-
(void)sz;
2942+
(void)ssl;
2943+
(void)sz;
29442944

2945-
if (len > sz)
2946-
len = sz;
2947-
XMEMCPY(buf, msg->buffer, len);
2948-
msg->buffer += len;
2949-
msg->length -= len;
2945+
if (len > sz)
2946+
len = sz;
2947+
XMEMCPY(buf, msg->buffer, len);
2948+
msg->buffer += len;
2949+
msg->length -= len;
29502950

2951-
return len;
2951+
return len;
29522952
}
29532953
#endif
29542954

@@ -2959,68 +2959,68 @@ static int DupEchRecv(WOLFSSL* ssl, char* buf, int sz, void* ctx)
29592959
*/
29602960
int test_tls13_duplicate_ech_extension(void)
29612961
{
2962-
EXPECT_DECLS;
2962+
EXPECT_DECLS;
29632963
#if defined(WOLFSSL_TLS13) && defined(HAVE_ECH) && \
29642964
!defined(NO_WOLFSSL_SERVER) && !defined(NO_FILESYSTEM) && \
29652965
(!defined(NO_RSA) || defined(HAVE_ECC))
2966-
/* TLS 1.3 ClientHello with two ECH extensions (type 0xfe0d).
2967-
* Extensions block contains: supported_versions + ECH + ECH (dup). */
2968-
const unsigned char clientHelloDupEch[] = {
2969-
0x16, 0x03, 0x03, 0x00, 0x40, 0x01, 0x00, 0x00,
2970-
0x3c, 0x03, 0x03, 0x01, 0x01, 0x01, 0x01, 0x01,
2971-
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
2972-
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
2973-
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
2974-
0x01, 0x01, 0x01, 0x00, 0x00, 0x02, 0x13, 0x01,
2975-
0x01, 0x00, 0x00, 0x11, 0x00, 0x2b, 0x00, 0x03,
2976-
0x02, 0x03, 0x04, 0xfe, 0x0d, 0x00, 0x01, 0x00,
2977-
0xfe, 0x0d, 0x00, 0x01, 0x00
2978-
};
2979-
WOLFSSL_BUFFER_INFO msg;
2980-
const char* testCertFile;
2981-
const char* testKeyFile;
2982-
WOLFSSL_CTX *ctx = NULL;
2983-
WOLFSSL *ssl = NULL;
2966+
/* TLS 1.3 ClientHello with two ECH extensions (type 0xfe0d).
2967+
* Extensions block contains: supported_versions + ECH + ECH (dup). */
2968+
const unsigned char clientHelloDupEch[] = {
2969+
0x16, 0x03, 0x03, 0x00, 0x40, 0x01, 0x00, 0x00,
2970+
0x3c, 0x03, 0x03, 0x01, 0x01, 0x01, 0x01, 0x01,
2971+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
2972+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
2973+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
2974+
0x01, 0x01, 0x01, 0x00, 0x00, 0x02, 0x13, 0x01,
2975+
0x01, 0x00, 0x00, 0x11, 0x00, 0x2b, 0x00, 0x03,
2976+
0x02, 0x03, 0x04, 0xfe, 0x0d, 0x00, 0x01, 0x00,
2977+
0xfe, 0x0d, 0x00, 0x01, 0x00
2978+
};
2979+
WOLFSSL_BUFFER_INFO msg;
2980+
const char* testCertFile;
2981+
const char* testKeyFile;
2982+
WOLFSSL_CTX *ctx = NULL;
2983+
WOLFSSL *ssl = NULL;
29842984

29852985
#ifndef NO_RSA
2986-
testCertFile = svrCertFile;
2987-
testKeyFile = svrKeyFile;
2986+
testCertFile = svrCertFile;
2987+
testKeyFile = svrKeyFile;
29882988
#elif defined(HAVE_ECC)
2989-
testCertFile = eccCertFile;
2990-
testKeyFile = eccKeyFile;
2989+
testCertFile = eccCertFile;
2990+
testKeyFile = eccKeyFile;
29912991
#endif
29922992

2993-
ExpectNotNull(ctx = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
2993+
ExpectNotNull(ctx = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
29942994

2995-
ExpectTrue(wolfSSL_CTX_use_certificate_file(ctx, testCertFile,
2996-
CERT_FILETYPE));
2997-
ExpectTrue(wolfSSL_CTX_use_PrivateKey_file(ctx, testKeyFile,
2998-
CERT_FILETYPE));
2995+
ExpectTrue(wolfSSL_CTX_use_certificate_file(ctx, testCertFile,
2996+
CERT_FILETYPE));
2997+
ExpectTrue(wolfSSL_CTX_use_PrivateKey_file(ctx, testKeyFile,
2998+
CERT_FILETYPE));
29992999

3000-
/* Read from 'msg'. */
3001-
wolfSSL_SetIORecv(ctx, DupEchRecv);
3002-
/* No where to send to - dummy sender. */
3003-
wolfSSL_SetIOSend(ctx, DupEchSend);
3000+
/* Read from 'msg'. */
3001+
wolfSSL_SetIORecv(ctx, DupEchRecv);
3002+
/* No where to send to - dummy sender. */
3003+
wolfSSL_SetIOSend(ctx, DupEchSend);
30043004

3005-
ssl = wolfSSL_new(ctx);
3006-
ExpectNotNull(ssl);
3005+
ssl = wolfSSL_new(ctx);
3006+
ExpectNotNull(ssl);
30073007

3008-
msg.buffer = (unsigned char*)clientHelloDupEch;
3009-
msg.length = (unsigned int)sizeof(clientHelloDupEch);
3010-
wolfSSL_SetIOReadCtx(ssl, &msg);
3008+
msg.buffer = (unsigned char*)clientHelloDupEch;
3009+
msg.length = (unsigned int)sizeof(clientHelloDupEch);
3010+
wolfSSL_SetIOReadCtx(ssl, &msg);
30113011

3012-
ExpectIntNE(wolfSSL_accept(ssl), WOLFSSL_SUCCESS);
3013-
/* Can return duplicate ext error or socket error if the peer closed
3014-
* down while sending alert. */
3015-
if (wolfSSL_get_error(ssl, 0) != WC_NO_ERR_TRACE(SOCKET_ERROR_E)) {
3016-
ExpectIntEQ(wolfSSL_get_error(ssl, 0),
3017-
WC_NO_ERR_TRACE(DUPLICATE_TLS_EXT_E));
3018-
}
3012+
ExpectIntNE(wolfSSL_accept(ssl), WOLFSSL_SUCCESS);
3013+
/* Can return duplicate ext error or socket error if the peer closed
3014+
* down while sending alert. */
3015+
if (wolfSSL_get_error(ssl, 0) != WC_NO_ERR_TRACE(SOCKET_ERROR_E)) {
3016+
ExpectIntEQ(wolfSSL_get_error(ssl, 0),
3017+
WC_NO_ERR_TRACE(DUPLICATE_TLS_EXT_E));
3018+
}
30193019

3020-
wolfSSL_free(ssl);
3021-
wolfSSL_CTX_free(ctx);
3020+
wolfSSL_free(ssl);
3021+
wolfSSL_CTX_free(ctx);
30223022
#endif
3023-
return EXPECT_RESULT();
3023+
return EXPECT_RESULT();
30243024
}
30253025

30263026

@@ -3801,12 +3801,15 @@ int test_tls13_empty_record_limit(void)
38013801
}
38023802

38033803
/* Build 1 non-empty record */
3804-
XMEMSET(dataRec, 0, sizeof(dataRec));
3805-
XMEMCPY(dataRec + RECORD_HEADER_SZ, payload, sizeof(payload));
3806-
ExpectIntEQ(BuildTls13Message(ssl_c, dataRec, (int)sizeof(dataRec),
3807-
dataRec + RECORD_HEADER_SZ, 1, application_data,
3808-
0, 0, 0), dataRecSz);
3809-
XMEMCPY(allRecs + emptyBefore * recSz, dataRec, (size_t)dataRecSz);
3804+
if (EXPECT_SUCCESS()) {
3805+
XMEMSET(dataRec, 0, sizeof(dataRec));
3806+
XMEMCPY(dataRec + RECORD_HEADER_SZ, payload, sizeof(payload));
3807+
ExpectIntEQ(BuildTls13Message(ssl_c, dataRec, (int)sizeof(dataRec),
3808+
dataRec + RECORD_HEADER_SZ, 1, application_data,
3809+
0, 0, 0), dataRecSz);
3810+
XMEMCPY(allRecs + emptyBefore * recSz, dataRec,
3811+
(size_t)dataRecSz);
3812+
}
38103813

38113814
/* Build (limit - 1) more empty records */
38123815
for (i = 0; i < emptyAfter && EXPECT_SUCCESS(); i++) {

0 commit comments

Comments
 (0)