Skip to content

Commit 3fa342a

Browse files
philljjphilljj
authored
Merge pull request #10812 from douzzer/20260629-linuxkm-fixes
20260629-linuxkm-fixes
2 parents b5636ff + 2af2a29 commit 3fa342a

4 files changed

Lines changed: 99 additions & 12 deletions

File tree

‎linuxkm/linuxkm_wc_port.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2000,7 +2000,7 @@
20002000
#define WC_LINUXKM_ROUND_UP_P_OF_2(x) ( \
20012001
{ \
20022002
size_t _alloc_sz = (x); \
2003-
if ((_alloc_sz < 8192) && (_alloc_sz != 0)) \
2003+
if ((_alloc_sz < 8192) && (_alloc_sz > 1)) \
20042004
_alloc_sz = 1UL << \
20052005
((sizeof(_alloc_sz) * 8UL) - __builtin_clzl(_alloc_sz - 1)); \
20062006
_alloc_sz; \

‎linuxkm/lkcapi_rsa_glue.c‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1259,6 +1259,12 @@ static int km_pkcs1pad_verify(struct akcipher_request *req)
12591259
goto pkcs1pad_verify_out;
12601260
}
12611261

1262+
/* bail if the padded ASN.1-prefixed digest won't fit in the given RSA key. */
1263+
if ((word64)ctx->digest_len + (word64)hash_enc_len + RSA_MIN_PAD_SZ > ctx->key_len) {
1264+
err = -EOVERFLOW;
1265+
goto pkcs1pad_verify_out;
1266+
}
1267+
12621268
work_buffer = malloc(2 * ctx->key_len);
12631269
if (unlikely(work_buffer == NULL)) {
12641270
err = -ENOMEM;
@@ -1513,6 +1519,12 @@ static int km_pkcs1_verify(struct crypto_sig *tfm,
15131519
goto pkcs1_verify_out;
15141520
}
15151521

1522+
/* bail if the padded ASN.1-prefixed digest won't fit in the given RSA key. */
1523+
if ((word64)ctx->digest_len + (word64)hash_enc_len + RSA_MIN_PAD_SZ > ctx->key_len) {
1524+
err = -EOVERFLOW;
1525+
goto pkcs1_verify_out;
1526+
}
1527+
15161528
work_buffer = malloc(2 * ctx->key_len);
15171529
if (unlikely(work_buffer == NULL)) {
15181530
err = -ENOMEM;

‎wolfcrypt/src/coding.c‎

Lines changed: 52 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,7 @@ int Base64_Decode_nonCT(const byte* in, word32 inLen, byte* out, word32* outLen)
192192
}
193193
e1 = in[j++];
194194
if (e1 == '\0') {
195+
inLen = 0;
195196
break;
196197
}
197198
inLen--;
@@ -230,11 +231,6 @@ int Base64_Decode_nonCT(const byte* in, word32 inLen, byte* out, word32* outLen)
230231
return ASN_INPUT_E;
231232
}
232233

233-
if (i + 1 + !pad3 + !pad4 > *outLen) {
234-
WOLFSSL_MSG("Bad Base64 Decode out buffer, too small");
235-
return BUFFER_E;
236-
}
237-
238234
e1 = Base64_Char2Val_by_table(e1);
239235
e2 = Base64_Char2Val_by_table(e2);
240236
e3 = (byte)((e3 == PAD) ? 0 : Base64_Char2Val_by_table(e3));
@@ -245,6 +241,11 @@ int Base64_Decode_nonCT(const byte* in, word32 inLen, byte* out, word32* outLen)
245241
return ASN_INPUT_E;
246242
}
247243

244+
if (i + 1 + !pad3 + !pad4 > *outLen) {
245+
WOLFSSL_MSG("Bad Base64 Decode out buffer, too small");
246+
return BUFFER_E;
247+
}
248+
248249
b1 = (byte)((e1 << 2) | (e2 >> 4));
249250
b2 = (byte)(((e2 & 0xF) << 4) | (e3 >> 2));
250251
b3 = (byte)(((e3 & 0x3) << 6) | e4);
@@ -258,6 +259,24 @@ int Base64_Decode_nonCT(const byte* in, word32 inLen, byte* out, word32* outLen)
258259
break;
259260
}
260261

262+
/* If there is still input available, and it's not whitespace or nulls, then
263+
* the input is invalid.
264+
*/
265+
while (inLen > 0) {
266+
word32 cur_j = j;
267+
if (in[j] == 0)
268+
break;
269+
if ((ret = Base64_SkipNewline(in, &inLen, &j)) != 0) {
270+
if (ret == WC_NO_ERR_TRACE(BUFFER_E)) {
271+
/* Running out of buffer here is not an error */
272+
break;
273+
}
274+
return ret;
275+
}
276+
if (j == cur_j)
277+
return ASN_INPUT_E;
278+
}
279+
261280
/* If the output buffer has a room for an extra byte, add a null terminator */
262281
if (out && *outLen > i)
263282
out[i]= '\0';
@@ -294,6 +313,7 @@ int Base64_Decode(const byte* in, word32 inLen, byte* out, word32* outLen)
294313
}
295314
e1 = in[j++];
296315
if (e1 == '\0') {
316+
inLen = 0;
297317
break;
298318
}
299319
inLen--;
@@ -321,11 +341,6 @@ int Base64_Decode(const byte* in, word32 inLen, byte* out, word32* outLen)
321341
if (pad3 && !pad4)
322342
return ASN_INPUT_E;
323343

324-
if (i + 1 + !pad3 + !pad4 > *outLen) {
325-
WOLFSSL_MSG("Bad Base64 Decode out buffer, too small");
326-
return BUFFER_E;
327-
}
328-
329344
e1 = Base64_Char2Val_CT(e1);
330345
e2 = Base64_Char2Val_CT(e2);
331346
e3 = (byte)((e3 == PAD) ? 0 : Base64_Char2Val_CT(e3));
@@ -336,6 +351,15 @@ int Base64_Decode(const byte* in, word32 inLen, byte* out, word32* outLen)
336351
return ASN_INPUT_E;
337352
}
338353

354+
/* Output space check needs to follow input character validation to
355+
* assure ASN_INPUT_E is returned on truncated input with the
356+
* terminating null included in the input buffer.
357+
*/
358+
if (i + 1 + !pad3 + !pad4 > *outLen) {
359+
WOLFSSL_MSG("Bad Base64 Decode out buffer, too small");
360+
return BUFFER_E;
361+
}
362+
339363
b1 = (byte)((e1 << 2) | (e2 >> 4));
340364
b2 = (byte)(((e2 & 0xF) << 4) | (e3 >> 2));
341365
b3 = (byte)(((e3 & 0x3) << 6) | e4);
@@ -349,6 +373,24 @@ int Base64_Decode(const byte* in, word32 inLen, byte* out, word32* outLen)
349373
break;
350374
}
351375

376+
/* If there is still input available, and it's not whitespace or nulls, then
377+
* the input is invalid.
378+
*/
379+
while (inLen > 0) {
380+
word32 cur_j = j;
381+
if (in[j] == 0)
382+
break;
383+
if ((ret = Base64_SkipNewline(in, &inLen, &j)) != 0) {
384+
if (ret == WC_NO_ERR_TRACE(BUFFER_E)) {
385+
/* Running out of buffer here is not an error */
386+
break;
387+
}
388+
return ret;
389+
}
390+
if (j == cur_j)
391+
return ASN_INPUT_E;
392+
}
393+
352394
/* If the output buffer has a room for an extra byte, add a null terminator */
353395
if (out && *outLen > i)
354396
out[i]= '\0';

‎wolfcrypt/test/test.c‎

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4130,12 +4130,18 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t base64_test(void)
41304130
static const byte goodChar[] =
41314131
"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
41324132
"abcdefghijklmnopqrstuvwxyz"
4133-
"0123456789+/;";
4133+
"0123456789+/";
41344134
static const byte charTest[] = "A+Gd\0\0\0";
41354135
static const byte oneByteTest[] = "YQ==";
41364136
static const byte twoByteTest[] = "YWE=";
41374137
static const byte threeByteTest[] = "YWFh";
41384138
static const byte fourByteTest[] = "YWFhYQ==";
4139+
static const byte trailingLFTest[] = "YWFhYQ==\n\n";
4140+
static const byte trailingSpaceTest[] = "YWFhYQ== ";
4141+
static const byte trailingCodesTest1[] = "YWFhY";
4142+
static const byte trailingCodesTest2[] = "YWFhYW";
4143+
static const byte trailingCodesTest3[] = "YWFhYWF";
4144+
static const byte trailingJunkTest[] = "YWFhYQ==X";
41394145
static const byte byteTestOutput[] = "aaaa";
41404146
int i;
41414147
WOLFSSL_ENTER("base64_test");
@@ -4255,6 +4261,26 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t base64_test(void)
42554261
N_BYTE_TEST(Base64_Decode, 3, threeByteTest);
42564262
N_BYTE_TEST(Base64_Decode, 4, fourByteTest);
42574263

4264+
#define N_BYTE_TRAILING_TEST(f, n, t, e) do { \
4265+
outLen = (n); \
4266+
ret = (f)(t, sizeof(t), out, &outLen); \
4267+
if (ret != (e)) \
4268+
return WC_TEST_RET_ENC_EC(ret); \
4269+
else if (ret == 0) { \
4270+
if (outLen != (n)) \
4271+
return WC_TEST_RET_ENC_I(outLen); \
4272+
if (XMEMCMP(out, byteTestOutput, n) != 0) \
4273+
return WC_TEST_RET_ENC_NC; \
4274+
} \
4275+
} while (0)
4276+
4277+
N_BYTE_TRAILING_TEST(Base64_Decode, 4, trailingLFTest, 0);
4278+
N_BYTE_TRAILING_TEST(Base64_Decode, 4, trailingSpaceTest, 0);
4279+
N_BYTE_TRAILING_TEST(Base64_Decode, 4, trailingCodesTest1, WC_NO_ERR_TRACE(ASN_INPUT_E));
4280+
N_BYTE_TRAILING_TEST(Base64_Decode, 4, trailingCodesTest2, WC_NO_ERR_TRACE(ASN_INPUT_E));
4281+
N_BYTE_TRAILING_TEST(Base64_Decode, 4, trailingCodesTest3, WC_NO_ERR_TRACE(ASN_INPUT_E));
4282+
N_BYTE_TRAILING_TEST(Base64_Decode, 4, trailingJunkTest, WC_NO_ERR_TRACE(ASN_INPUT_E));
4283+
42584284
/* Same tests again, using Base64_Decode_nonCT() */
42594285

42604286
/* Good Base64 encodings. */
@@ -4335,6 +4361,13 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t base64_test(void)
43354361
N_BYTE_TEST(Base64_Decode_nonCT, 3, threeByteTest);
43364362
N_BYTE_TEST(Base64_Decode_nonCT, 4, fourByteTest);
43374363

4364+
N_BYTE_TRAILING_TEST(Base64_Decode_nonCT, 4, trailingLFTest, 0);
4365+
N_BYTE_TRAILING_TEST(Base64_Decode_nonCT, 4, trailingSpaceTest, 0);
4366+
N_BYTE_TRAILING_TEST(Base64_Decode_nonCT, 4, trailingCodesTest1, WC_NO_ERR_TRACE(ASN_INPUT_E));
4367+
N_BYTE_TRAILING_TEST(Base64_Decode_nonCT, 4, trailingCodesTest2, WC_NO_ERR_TRACE(ASN_INPUT_E));
4368+
N_BYTE_TRAILING_TEST(Base64_Decode_nonCT, 4, trailingCodesTest3, WC_NO_ERR_TRACE(ASN_INPUT_E));
4369+
N_BYTE_TRAILING_TEST(Base64_Decode_nonCT, 4, trailingJunkTest, WC_NO_ERR_TRACE(ASN_INPUT_E));
4370+
43384371
#ifdef WOLFSSL_BASE64_ENCODE
43394372
/* Decode and encode all symbols - non-alphanumeric. */
43404373
dataLen = sizeof(data);

0 commit comments

Comments
 (0)