Skip to content

wolfCrypt and TLS 1.3 correctness fixes (F-1376, F-2653, F-1972, F-4593) #10930

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
julek-wolfssl wants to merge 4 commits into
base: master
Choose a base branch
from
+18 −10
Open

wolfCrypt and TLS 1.3 correctness fixes (F-1376, F-2653, F-1972, F-4593) #10930

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9f323ae
Validate NULL parameters in wc_AesCbcEncryptWithKey (F-1376)
julek-wolfssl Jul 16, 2026
d3ea746
Fix ChaCha20 EVP counter reconstruction shift UB (F-2653)
julek-wolfssl Jul 16, 2026
8bec574
Fix strict-aliasing violation in PrintPubKeyDH length (F-1972)
julek-wolfssl Jul 16, 2026
93320f2
Send unexpected_message alert on duplicate TLS 1.3 handshake msg (F-4…
julek-wolfssl Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/internal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36925,6 +36925,7 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
case WC_NO_ERR_TRACE(BAD_CERTIFICATE_STATUS_ERROR):
return bad_certificate_status_response;
case WC_NO_ERR_TRACE(OUT_OF_ORDER_E):
case WC_NO_ERR_TRACE(DUPLICATE_MSG_E):
return unexpected_message;
default:
return invalid_alert;
Expand Down
23 changes: 13 additions & 10 deletions wolfcrypt/src/evp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8345,8 +8345,8 @@ void wolfSSL_EVP_init(void)
* combines them to a new iv. EVP is given exactly *one* iv,
* so to pass it into chacha, we have to revert that first.
* The counter comes first in little-endian */
word32 counter = (word32)iv[0] + (word32)(iv[1] << 8) +
(word32)(iv[2] << 16) + (word32)(iv[3] << 24);
word32 counter = (word32)iv[0] | ((word32)iv[1] << 8) |
((word32)iv[2] << 16) | ((word32)iv[3] << 24);
if (wc_Chacha_SetIV(&ctx->cipher.chacha,
iv + sizeof(counter), counter) != 0) {

Expand Down Expand Up @@ -13056,7 +13056,10 @@ static int PrintPubKeyDH(WOLFSSL_BIO* out, const byte* pkey, int pkeySz,

byte buff[WOLFSSL_EVP_EXPONENT_PRINT_MAX] = { 0 };
int res = WC_NO_ERR_TRACE(WOLFSSL_FAILURE);
word32 length;
/* int (not word32) to match the int* out-parameter of GetSequence/GetLength;
* casting &length aliased a word32 and corrupted it on platforms where
* sizeof(int) != sizeof(word32). Values are non-negative ASN.1 lengths. */
int length;
word32 inOutIdx;
word32 oid;
byte tagFound;
Expand Down Expand Up @@ -13092,17 +13095,17 @@ static int PrintPubKeyDH(WOLFSSL_BIO* out, const byte* pkey, int pkeySz,
int idx;
int wsz;

if (GetSequence(pkey, &inOutIdx, (int*)&length, (word32)pkeySz) < 0) {
if (GetSequence(pkey, &inOutIdx, &length, (word32)pkeySz) < 0) {
break;
}
if (GetSequence(pkey, &inOutIdx, (int*)&length, (word32)pkeySz) < 0) {
if (GetSequence(pkey, &inOutIdx, &length, (word32)pkeySz) < 0) {
break;
}
if (GetObjectId(pkey, &inOutIdx, &oid, oidIgnoreType, (word32)pkeySz) <
0) {
break;
}
if (GetSequence(pkey, &inOutIdx, (int*)&length, (word32)pkeySz) < 0) {
if (GetSequence(pkey, &inOutIdx, &length, (word32)pkeySz) < 0) {
break;
}
/* get prime element */
Expand All @@ -13112,7 +13115,7 @@ static int PrintPubKeyDH(WOLFSSL_BIO* out, const byte* pkey, int pkeySz,
if (tagFound != ASN_INTEGER) {
break;
}
if (GetLength(pkey, &inOutIdx, (int*)&length, (word32)pkeySz) <= 0) {
if (GetLength(pkey, &inOutIdx, &length, (word32)pkeySz) <= 0) {
break;
}
prime = (byte*)(pkey + inOutIdx);
Expand All @@ -13126,7 +13129,7 @@ static int PrintPubKeyDH(WOLFSSL_BIO* out, const byte* pkey, int pkeySz,
if (tagFound != ASN_INTEGER) {
break;
}
if (GetLength(pkey, &inOutIdx, (int*)&length, (word32)pkeySz) <= 0) {
if (GetLength(pkey, &inOutIdx, &length, (word32)pkeySz) <= 0) {
break;
}
if (length != 1) {
Expand All @@ -13142,7 +13145,7 @@ static int PrintPubKeyDH(WOLFSSL_BIO* out, const byte* pkey, int pkeySz,
if (tagFound != ASN_BIT_STRING) {
break;
}
if (GetLength(pkey, &inOutIdx, (int*)&length, (word32)pkeySz) <= 0) {
if (GetLength(pkey, &inOutIdx, &length, (word32)pkeySz) <= 0) {
break;
}
inOutIdx ++;
Expand All @@ -13152,7 +13155,7 @@ static int PrintPubKeyDH(WOLFSSL_BIO* out, const byte* pkey, int pkeySz,
if (tagFound != ASN_INTEGER) {
break;
}
if (GetLength(pkey, &inOutIdx, (int*)&length, (word32)pkeySz) <= 0) {
if (GetLength(pkey, &inOutIdx, &length, (word32)pkeySz) <= 0) {
break;
}
publicKeySz = (int)length;
Expand Down
4 changes: 4 additions & 0 deletions wolfcrypt/src/wc_encrypt.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,10 @@ int wc_AesCbcEncryptWithKey(byte* out, const byte* in, word32 inSz,
int ret = 0;
WC_DECLARE_VAR(aes, Aes, 1, 0);

if (out == NULL || in == NULL || key == NULL || iv == NULL) {
return BAD_FUNC_ARG;
}

WC_ALLOC_VAR_EX(aes, Aes, 1, NULL, DYNAMIC_TYPE_TMP_BUFFER,
return MEMORY_E);

Expand Down
Loading