Skip to content

Commit d205fca

Browse files
Fix potential overflows in two additional hash functions.
Thanks to Arjuna Arya for the report. Fixes #9955.
1 parent 091016a commit d205fca

2 files changed

Lines changed: 9 additions & 1 deletion

File tree

wolfcrypt/src/hash.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1954,6 +1954,11 @@ int wc_HashGetFlags(wc_HashAlg* hash, enum wc_HashType type, word32* flags)
19541954
int _wc_Hash_Grow(byte** msg, word32* used, word32* len, const byte* in,
19551955
int inSz, void* heap)
19561956
{
1957+
word32 tmpSz = 0;
1958+
1959+
if (!WC_SAFE_SUM_WORD32(*used, inSz, tmpSz))
1960+
return BAD_FUNC_ARG;
1961+
19571962
if (*len < *used + inSz) {
19581963
if (*msg == NULL) {
19591964
*msg = (byte*)XMALLOC(*used + inSz, heap, DYNAMIC_TYPE_TMP_BUFFER);

wolfcrypt/src/port/ti/ti-hash.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,8 +75,11 @@ static int hashInit(wolfssl_TI_Hash *hash)
7575
static int hashUpdate(wolfssl_TI_Hash *hash, const byte* data, word32 len)
7676
{
7777
void *p;
78+
word32 tmpSz = 0;
7879

79-
if ((hash== NULL) || (data == NULL))return BAD_FUNC_ARG;
80+
if ((hash== NULL) || (data == NULL) ||
81+
!WC_SAFE_SUM_WORD32(hash->used, len, tmpSz))
82+
return BAD_FUNC_ARG;
8083

8184
if (hash->len < hash->used+len) {
8285
if (hash->msg == NULL) {

0 commit comments

Comments
 (0)