Skip to content

Commit b44d8c6

Browse files
SparkiDevSparkiDev
authored
Merge pull request #10192 from mattia-moffa/20260409-fixes
Various fixes
2 parents 18b0d31 + 6b535a4 commit b44d8c6

10 files changed

Lines changed: 291 additions & 9 deletions

File tree

‎tests/api/test_evp_pkey.c‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -382,6 +382,76 @@ int test_wolfSSL_EVP_MD_hmac_signing(void)
382382
return EXPECT_RESULT();
383383
}
384384

385+
/* Verify that EVP_DigestVerifyFinal rejects zero-length HMAC tags. */
386+
int test_wolfSSL_EVP_DigestVerify_HMAC_zero_len_forgery(void)
387+
{
388+
EXPECT_DECLS;
389+
#if defined(OPENSSL_EXTRA) && !defined(NO_HMAC) && !defined(NO_SHA256)
390+
static const unsigned char key[] = {
391+
0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
392+
0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
393+
0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
394+
0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b
395+
};
396+
static const char message[] = "wolfSSL DigestVerifyFinal forgery probe";
397+
static const unsigned char zeros[WC_MAX_DIGEST_SIZE] = { 0 };
398+
399+
WOLFSSL_EVP_PKEY* pkey = NULL;
400+
WOLFSSL_EVP_MD_CTX mdCtx;
401+
unsigned char tag[WC_MAX_DIGEST_SIZE];
402+
size_t tagLen = sizeof(tag);
403+
404+
wolfSSL_EVP_MD_CTX_init(&mdCtx);
405+
406+
ExpectNotNull(pkey = wolfSSL_EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL,
407+
key, (int)sizeof(key)));
408+
409+
/* Compute the genuine HMAC-SHA256 tag for the message. */
410+
ExpectIntEQ(wolfSSL_EVP_DigestSignInit(&mdCtx, NULL, wolfSSL_EVP_sha256(),
411+
NULL, pkey), 1);
412+
ExpectIntEQ(wolfSSL_EVP_DigestSignUpdate(&mdCtx, message,
413+
(unsigned int)XSTRLEN(message)),
414+
1);
415+
ExpectIntEQ(wolfSSL_EVP_DigestSignFinal(&mdCtx, tag, &tagLen), 1);
416+
ExpectIntEQ((int)tagLen, WC_SHA256_DIGEST_SIZE);
417+
ExpectIntEQ(wolfSSL_EVP_MD_CTX_cleanup(&mdCtx), 1);
418+
419+
/* Full-length genuine tag verifies. */
420+
wolfSSL_EVP_MD_CTX_init(&mdCtx);
421+
ExpectIntEQ(wolfSSL_EVP_DigestVerifyInit(&mdCtx, NULL, wolfSSL_EVP_sha256(),
422+
NULL, pkey), 1);
423+
ExpectIntEQ(wolfSSL_EVP_DigestVerifyUpdate(&mdCtx, message,
424+
(unsigned int)XSTRLEN(message)),
425+
1);
426+
ExpectIntEQ(wolfSSL_EVP_DigestVerifyFinal(&mdCtx, tag, tagLen), 1);
427+
ExpectIntEQ(wolfSSL_EVP_MD_CTX_cleanup(&mdCtx), 1);
428+
429+
/* Wrong full-length tag is rejected. */
430+
wolfSSL_EVP_MD_CTX_init(&mdCtx);
431+
ExpectIntEQ(wolfSSL_EVP_DigestVerifyInit(&mdCtx, NULL, wolfSSL_EVP_sha256(),
432+
NULL, pkey), 1);
433+
ExpectIntEQ(wolfSSL_EVP_DigestVerifyUpdate(&mdCtx, message,
434+
(unsigned int)XSTRLEN(message)),
435+
1);
436+
ExpectIntNE(wolfSSL_EVP_DigestVerifyFinal(&mdCtx, zeros,
437+
WC_SHA256_DIGEST_SIZE), 1);
438+
ExpectIntEQ(wolfSSL_EVP_MD_CTX_cleanup(&mdCtx), 1);
439+
440+
/* Zero-length tag must be rejected. */
441+
wolfSSL_EVP_MD_CTX_init(&mdCtx);
442+
ExpectIntEQ(wolfSSL_EVP_DigestVerifyInit(&mdCtx, NULL, wolfSSL_EVP_sha256(),
443+
NULL, pkey), 1);
444+
ExpectIntEQ(wolfSSL_EVP_DigestVerifyUpdate(&mdCtx, message,
445+
(unsigned int)XSTRLEN(message)),
446+
1);
447+
ExpectIntNE(wolfSSL_EVP_DigestVerifyFinal(&mdCtx, zeros, 0), 1);
448+
ExpectIntEQ(wolfSSL_EVP_MD_CTX_cleanup(&mdCtx), 1);
449+
450+
wolfSSL_EVP_PKEY_free(pkey);
451+
#endif
452+
return EXPECT_RESULT();
453+
}
454+
385455
int test_wolfSSL_EVP_PKEY_new_mac_key(void)
386456
{
387457
EXPECT_DECLS;

‎tests/api/test_evp_pkey.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ int test_wolfSSL_EVP_PKEY_base_id(void);
3232
int test_wolfSSL_EVP_PKEY_id(void);
3333
int test_wolfSSL_EVP_MD_pkey_type(void);
3434
int test_wolfSSL_EVP_MD_hmac_signing(void);
35+
int test_wolfSSL_EVP_DigestVerify_HMAC_zero_len_forgery(void);
3536
int test_wolfSSL_EVP_PKEY_new_mac_key(void);
3637
int test_wolfSSL_EVP_PKEY_hkdf(void);
3738
int test_wolfSSL_EVP_PBE_scrypt(void);
@@ -70,6 +71,8 @@ int test_wolfSSL_EVP_PKEY_print_public(void);
7071
TEST_DECL_GROUP("evp_pkey", test_wolfSSL_EVP_PKEY_id), \
7172
TEST_DECL_GROUP("evp_pkey", test_wolfSSL_EVP_MD_pkey_type), \
7273
TEST_DECL_GROUP("evp_pkey", test_wolfSSL_EVP_MD_hmac_signing), \
74+
TEST_DECL_GROUP("evp_pkey", \
75+
test_wolfSSL_EVP_DigestVerify_HMAC_zero_len_forgery), \
7376
TEST_DECL_GROUP("evp_pkey", test_wolfSSL_EVP_PKEY_new_mac_key), \
7477
TEST_DECL_GROUP("evp_pkey", test_wolfSSL_EVP_PKEY_hkdf), \
7578
TEST_DECL_GROUP("evp_pkey", test_wolfSSL_EVP_PBE_scrypt), \

‎tests/api/test_mlkem.c‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3950,3 +3950,71 @@ int test_wc_mlkem_decapsulate_pubonly_fails(void)
39503950
return EXPECT_RESULT();
39513951
} /* END test_wc_mlkem_decapsulate_pubonly_fails */
39523952

3953+
/* Verify that the re-encryption check catches ciphertext tampering
3954+
* at various byte offsets and falls back to implicit rejection. */
3955+
int test_wc_mlkem_decap_fo_reject(void)
3956+
{
3957+
EXPECT_DECLS;
3958+
#if !defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0)
3959+
#if defined(WOLFSSL_HAVE_MLKEM) && defined(WOLFSSL_WC_MLKEM) && \
3960+
!defined(WOLFSSL_NO_ML_KEM) && !defined(WOLFSSL_MLKEM_NO_DECAPSULATE) && \
3961+
!defined(WOLFSSL_MLKEM_NO_ENCAPSULATE) && \
3962+
!defined(WOLFSSL_MLKEM_NO_MAKE_KEY)
3963+
MlKemKey* key = NULL;
3964+
WC_RNG rng;
3965+
byte ct[WC_ML_KEM_MAX_CIPHER_TEXT_SIZE];
3966+
byte ctTampered[WC_ML_KEM_MAX_CIPHER_TEXT_SIZE];
3967+
byte ss[WC_ML_KEM_SS_SZ];
3968+
byte ssDec[WC_ML_KEM_SS_SZ];
3969+
byte ssTampered[WC_ML_KEM_SS_SZ];
3970+
word32 ctLen = 0;
3971+
3972+
XMEMSET(ct, 0, sizeof(ct));
3973+
XMEMSET(ctTampered, 0, sizeof(ctTampered));
3974+
XMEMSET(ss, 0, sizeof(ss));
3975+
3976+
key = (MlKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
3977+
ExpectNotNull(key);
3978+
3979+
XMEMSET(&rng, 0, sizeof(rng));
3980+
ExpectIntEQ(wc_InitRng(&rng), 0);
3981+
3982+
#ifndef WOLFSSL_NO_ML_KEM_768
3983+
ExpectIntEQ(wc_MlKemKey_Init(key, WC_ML_KEM_768, NULL, INVALID_DEVID), 0);
3984+
#elif !defined(WOLFSSL_NO_ML_KEM_512)
3985+
ExpectIntEQ(wc_MlKemKey_Init(key, WC_ML_KEM_512, NULL, INVALID_DEVID), 0);
3986+
#else
3987+
ExpectIntEQ(wc_MlKemKey_Init(key, WC_ML_KEM_1024, NULL, INVALID_DEVID), 0);
3988+
#endif
3989+
3990+
ExpectIntEQ(wc_MlKemKey_CipherTextSize(key, &ctLen), 0);
3991+
ExpectIntEQ(wc_MlKemKey_MakeKey(key, &rng), 0);
3992+
ExpectIntEQ(wc_MlKemKey_Encapsulate(key, ct, ss, &rng), 0);
3993+
3994+
/* Untampered ciphertext recovers the original ss. */
3995+
XMEMSET(ssDec, 0, sizeof(ssDec));
3996+
ExpectIntEQ(wc_MlKemKey_Decapsulate(key, ssDec, ct, ctLen), 0);
3997+
ExpectIntEQ(XMEMCMP(ssDec, ss, WC_ML_KEM_SS_SZ), 0);
3998+
3999+
/* Tamper at byte 32: implicit rejection must fire. */
4000+
XMEMCPY(ctTampered, ct, ctLen);
4001+
ctTampered[32] ^= 0x01;
4002+
XMEMSET(ssTampered, 0, sizeof(ssTampered));
4003+
ExpectIntEQ(wc_MlKemKey_Decapsulate(key, ssTampered, ctTampered, ctLen), 0);
4004+
ExpectIntNE(XMEMCMP(ssTampered, ss, WC_ML_KEM_SS_SZ), 0);
4005+
4006+
/* Tamper at byte 0: also must be rejected. */
4007+
XMEMCPY(ctTampered, ct, ctLen);
4008+
ctTampered[0] ^= 0x01;
4009+
XMEMSET(ssTampered, 0, sizeof(ssTampered));
4010+
ExpectIntEQ(wc_MlKemKey_Decapsulate(key, ssTampered, ctTampered, ctLen), 0);
4011+
ExpectIntNE(XMEMCMP(ssTampered, ss, WC_ML_KEM_SS_SZ), 0);
4012+
4013+
DoExpectIntEQ(wc_FreeRng(&rng), 0);
4014+
wc_MlKemKey_Free(key);
4015+
XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4016+
#endif
4017+
#endif
4018+
return EXPECT_RESULT();
4019+
} /* END test_wc_mlkem_decap_fo_reject */
4020+

‎tests/api/test_mlkem.h‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,13 @@ int test_wc_mlkem_make_key_kats(void);
2828
int test_wc_mlkem_encapsulate_kats(void);
2929
int test_wc_mlkem_decapsulate_kats(void);
3030
int test_wc_mlkem_decapsulate_pubonly_fails(void);
31+
int test_wc_mlkem_decap_fo_reject(void);
3132

32-
#define TEST_MLKEM_DECLS \
33-
TEST_DECL_GROUP("mlkem", test_wc_mlkem_make_key_kats), \
34-
TEST_DECL_GROUP("mlkem", test_wc_mlkem_encapsulate_kats), \
35-
TEST_DECL_GROUP("mlkem", test_wc_mlkem_decapsulate_kats), \
36-
TEST_DECL_GROUP("mlkem", test_wc_mlkem_decapsulate_pubonly_fails)
33+
#define TEST_MLKEM_DECLS \
34+
TEST_DECL_GROUP("mlkem", test_wc_mlkem_make_key_kats), \
35+
TEST_DECL_GROUP("mlkem", test_wc_mlkem_encapsulate_kats), \
36+
TEST_DECL_GROUP("mlkem", test_wc_mlkem_decapsulate_kats), \
37+
TEST_DECL_GROUP("mlkem", test_wc_mlkem_decapsulate_pubonly_fails), \
38+
TEST_DECL_GROUP("mlkem", test_wc_mlkem_decap_fo_reject)
3739

3840
#endif /* WOLFCRYPT_TEST_MLKEM_H */

‎tests/api/test_pkcs12.c‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
#include <wolfcrypt/src/misc.c>
2929
#endif
3030

31+
#include <wolfssl/wolfcrypt/hmac.h>
3132
#include <wolfssl/wolfcrypt/pkcs12.h>
3233
#include <wolfssl/wolfcrypt/pwdbased.h>
3334
#include <wolfssl/wolfcrypt/types.h>
@@ -465,6 +466,137 @@ int test_wc_PKCS12_encrypted_content_bounds(void)
465466
return EXPECT_RESULT();
466467
}
467468

469+
/* Test that a crafted PKCS12 with a MAC OCTET STRING shorter than the
470+
* algorithm's native digest size is rejected, rather than allowing the
471+
* integrity check to be truncated to a brute-forceable length. */
472+
int test_wc_PKCS12_truncated_mac_bypass(void)
473+
{
474+
EXPECT_DECLS;
475+
#if !defined(NO_ASN) && !defined(NO_PWDBASED) && defined(HAVE_PKCS12) \
476+
&& !defined(NO_HMAC) && !defined(NO_SHA256)
477+
static const byte authSafe[] = { 0x30, 0x00 }; /* empty SEQUENCE OF CI */
478+
static const char password[] = "wolfSSL test";
479+
static const byte salt[8] = {
480+
0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08
481+
};
482+
const int iter = 1;
483+
const word32 pwLen = (word32)(sizeof(password) - 1);
484+
485+
byte unicodePw[2 * sizeof(password) + 2];
486+
int unicodePwLen = 0;
487+
byte macKey[WC_SHA256_DIGEST_SIZE];
488+
byte fullMac[WC_SHA256_DIGEST_SIZE] = {0};
489+
Hmac hmac;
490+
int hmacInited = 0;
491+
word32 i;
492+
493+
WC_PKCS12* pkcs12 = NULL;
494+
byte pfx[64];
495+
word32 pfxLen = 0;
496+
497+
/* BMPString-style password (UTF-16BE) with trailing 0x00 0x00, matching
498+
* the unicode conversion done internally by wc_PKCS12_create_mac. */
499+
for (i = 0; i < pwLen; i++) {
500+
unicodePw[unicodePwLen++] = 0x00;
501+
unicodePw[unicodePwLen++] = (byte)password[i];
502+
}
503+
unicodePw[unicodePwLen++] = 0x00;
504+
unicodePw[unicodePwLen++] = 0x00;
505+
506+
/* Derive the MAC key the same way wc_PKCS12_create_mac does:
507+
* PKCS12-PBKDF SHA-256, id=3 (MAC key), kLen=32. */
508+
ExpectIntEQ(wc_PKCS12_PBKDF_ex(macKey, unicodePw, unicodePwLen,
509+
salt, (int)sizeof(salt),
510+
iter, WC_SHA256_DIGEST_SIZE,
511+
WC_SHA256, 3 /* id = MAC */, NULL),
512+
0);
513+
514+
/* Compute the genuine HMAC-SHA256 over the authSafe content. */
515+
ExpectIntEQ(wc_HmacInit(&hmac, NULL, INVALID_DEVID), 0);
516+
if (EXPECT_SUCCESS())
517+
hmacInited = 1;
518+
ExpectIntEQ(wc_HmacSetKey(&hmac, WC_SHA256, macKey, sizeof(macKey)), 0);
519+
ExpectIntEQ(wc_HmacUpdate(&hmac, authSafe, (word32)sizeof(authSafe)), 0);
520+
ExpectIntEQ(wc_HmacFinal(&hmac, fullMac), 0);
521+
if (hmacInited)
522+
wc_HmacFree(&hmac);
523+
524+
/*
525+
* Build a 59-byte PFX with a 1-byte truncated digest equal to fullMac[0]:
526+
*
527+
* 30 39 PFX SEQUENCE (57)
528+
* 02 01 03 version = 3
529+
* 30 11 AuthSafe ContentInfo (17)
530+
* 06 09 2A 86 48 86 F7 0D 01 07 01 OID 1.2.840.113549.1.7.1 (data)
531+
* A0 04 [0] EXPLICIT (4)
532+
* 04 02 OCTET STRING (2)
533+
* 30 00 authSafe = empty SEQUENCE
534+
* 30 21 MacData (33)
535+
* 30 12 DigestInfo (18)
536+
* 30 0d AlgorithmIdentifier (13)
537+
* 06 09 60 86 48 01 65 03 04 02 01 OID SHA-256
538+
* 05 00 NULL
539+
* 04 01 XX OCTET STRING (1)
540+
* 04 08 01 02 03 04 05 06 07 08 salt
541+
* 02 01 01 iterations = 1
542+
*/
543+
pfx[pfxLen++] = 0x30; pfx[pfxLen++] = 0x39;
544+
pfx[pfxLen++] = 0x02; pfx[pfxLen++] = 0x01; pfx[pfxLen++] = 0x03;
545+
pfx[pfxLen++] = 0x30; pfx[pfxLen++] = 0x11;
546+
pfx[pfxLen++] = 0x06; pfx[pfxLen++] = 0x09;
547+
pfx[pfxLen++] = 0x2A; pfx[pfxLen++] = 0x86; pfx[pfxLen++] = 0x48;
548+
pfx[pfxLen++] = 0x86; pfx[pfxLen++] = 0xF7; pfx[pfxLen++] = 0x0D;
549+
pfx[pfxLen++] = 0x01; pfx[pfxLen++] = 0x07; pfx[pfxLen++] = 0x01;
550+
pfx[pfxLen++] = 0xA0; pfx[pfxLen++] = 0x04;
551+
pfx[pfxLen++] = 0x04; pfx[pfxLen++] = 0x02;
552+
pfx[pfxLen++] = 0x30; pfx[pfxLen++] = 0x00;
553+
pfx[pfxLen++] = 0x30; pfx[pfxLen++] = 0x21;
554+
pfx[pfxLen++] = 0x30; pfx[pfxLen++] = 0x12;
555+
pfx[pfxLen++] = 0x30; pfx[pfxLen++] = 0x0D;
556+
pfx[pfxLen++] = 0x06; pfx[pfxLen++] = 0x09;
557+
pfx[pfxLen++] = 0x60; pfx[pfxLen++] = 0x86; pfx[pfxLen++] = 0x48;
558+
pfx[pfxLen++] = 0x01; pfx[pfxLen++] = 0x65; pfx[pfxLen++] = 0x03;
559+
pfx[pfxLen++] = 0x04; pfx[pfxLen++] = 0x02; pfx[pfxLen++] = 0x01;
560+
pfx[pfxLen++] = 0x05; pfx[pfxLen++] = 0x00;
561+
pfx[pfxLen++] = 0x04; pfx[pfxLen++] = 0x01;
562+
pfx[pfxLen++] = fullMac[0];
563+
pfx[pfxLen++] = 0x04; pfx[pfxLen++] = 0x08;
564+
pfx[pfxLen++] = 0x01; pfx[pfxLen++] = 0x02; pfx[pfxLen++] = 0x03;
565+
pfx[pfxLen++] = 0x04; pfx[pfxLen++] = 0x05; pfx[pfxLen++] = 0x06;
566+
pfx[pfxLen++] = 0x07; pfx[pfxLen++] = 0x08;
567+
pfx[pfxLen++] = 0x02; pfx[pfxLen++] = 0x01; pfx[pfxLen++] = 0x01;
568+
569+
{
570+
byte* parsedPkey = NULL;
571+
word32 parsedPkeySz = 0;
572+
byte* parsedCert = NULL;
573+
word32 parsedCertSz = 0;
574+
int d2iRet;
575+
576+
ExpectNotNull(pkcs12 = wc_PKCS12_new());
577+
578+
/* Accept rejection at either parse time (wc_d2i_PKCS12) or
579+
* verify time (wc_PKCS12_parse); the test fails only if both
580+
* succeed. */
581+
d2iRet = wc_d2i_PKCS12(pfx, pfxLen, pkcs12);
582+
if (d2iRet == 0) {
583+
ExpectIntNE(wc_PKCS12_parse(pkcs12, password,
584+
&parsedPkey, &parsedPkeySz,
585+
&parsedCert, &parsedCertSz, NULL),
586+
0);
587+
}
588+
else {
589+
ExpectIntNE(d2iRet, 0);
590+
}
591+
592+
XFREE(parsedPkey, NULL, DYNAMIC_TYPE_PUBLIC_KEY);
593+
XFREE(parsedCert, NULL, DYNAMIC_TYPE_PKCS);
594+
wc_PKCS12_free(pkcs12);
595+
}
596+
#endif
597+
return EXPECT_RESULT();
598+
}
599+
468600
int test_wc_PKCS12_PBKDF(void)
469601
{
470602
EXPECT_DECLS;

‎tests/api/test_pkcs12.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ int test_wc_PKCS12_create(void);
2929
int test_wc_d2i_PKCS12_bad_mac_salt(void);
3030
int test_wc_d2i_PKCS12_oid_underflow(void);
3131
int test_wc_PKCS12_encrypted_content_bounds(void);
32+
int test_wc_PKCS12_truncated_mac_bypass(void);
3233
int test_wc_PKCS12_PBKDF(void);
3334
int test_wc_PKCS12_PBKDF_ex(void);
3435
int test_wc_PKCS12_PBKDF_ex_sha1(void);
@@ -44,6 +45,7 @@ int test_wc_PKCS12_PBKDF_ex_sha512_256(void);
4445
TEST_DECL_GROUP("pkcs12", test_wc_d2i_PKCS12_bad_mac_salt), \
4546
TEST_DECL_GROUP("pkcs12", test_wc_d2i_PKCS12_oid_underflow), \
4647
TEST_DECL_GROUP("pkcs12", test_wc_PKCS12_encrypted_content_bounds), \
48+
TEST_DECL_GROUP("pkcs12", test_wc_PKCS12_truncated_mac_bypass), \
4749
TEST_DECL_GROUP("pkcs12", test_wc_PKCS12_PBKDF), \
4850
TEST_DECL_GROUP("pkcs12", test_wc_PKCS12_PBKDF_ex), \
4951
TEST_DECL_GROUP("pkcs12", test_wc_PKCS12_PBKDF_ex_sha1), \

‎wolfcrypt/src/evp.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4992,9 +4992,8 @@ int wolfSSL_EVP_DigestVerifyFinal(WOLFSSL_EVP_MD_CTX *ctx,
49924992

49934993
hashLen = wolfssl_mac_len(ctx->hash.hmac.macType);
49944994

4995-
if (siglen > hashLen || siglen > INT_MAX)
4995+
if (hashLen == 0 || siglen != hashLen)
49964996
return WOLFSSL_FAILURE;
4997-
/* May be a truncated signature. */
49984997
}
49994998

50004999
if (wolfssl_evp_digest_pk_final(ctx, digest, &hashLen) <= 0)

‎wolfcrypt/src/pkcs12.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -633,6 +633,12 @@ static int wc_PKCS12_verify(WC_PKCS12* pkcs12, byte* data, word32 dataSz,
633633
return ret;
634634
}
635635

636+
if ((word32)ret != mac->digestSz) {
637+
WOLFSSL_MSG("PKCS12 MAC digest size mismatch");
638+
ForceZero(digest, sizeof(digest));
639+
return MAC_CMP_FAILED_E;
640+
}
641+
636642
#ifdef WOLFSSL_DEBUG_PKCS12
637643
{
638644
byte* p;

‎wolfcrypt/src/port/arm/armv8-mlkem-asm.S‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8927,7 +8927,7 @@ L_mlkem_aarch64_cmp_neon_done:
89278927
orr v8.16b, v8.16b, v9.16b
89288928
orr v10.16b, v10.16b, v11.16b
89298929
orr v8.16b, v8.16b, v10.16b
8930-
ins v9.b[0], v8.b[1]
8930+
ext v9.16b, v8.16b, v8.16b, #8
89318931
orr v8.16b, v8.16b, v9.16b
89328932
mov x0, v8.d[0]
89338933
subs x0, x0, xzr

‎wolfcrypt/src/port/arm/armv8-mlkem-asm_c.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8404,7 +8404,7 @@ int mlkem_cmp_neon(const byte* a, const byte* b, int sz)
84048404
"orr v8.16b, v8.16b, v9.16b\n\t"
84058405
"orr v10.16b, v10.16b, v11.16b\n\t"
84068406
"orr v8.16b, v8.16b, v10.16b\n\t"
8407-
"ins v9.b[0], v8.b[1]\n\t"
8407+
"ext v9.16b, v8.16b, v8.16b, #8\n\t"
84088408
"orr v8.16b, v8.16b, v9.16b\n\t"
84098409
"mov x0, v8.d[0]\n\t"
84108410
"subs x0, x0, xzr\n\t"

0 commit comments

Comments
 (0)