Fix DSA signature length handling in certificate verification

[gasbytes]

Description

Size the DSA signature copy from the verifying key's q, zero-pad each half of an ASN.1-encoded signature to that width, and reject a q outside the range wolfCrypt can sign with. Adds a unit test.

Thanks to Anthropic for the report.

Testing

Added associated regression test (test_wc_DsaVerify_cert_sig_narrower_than_q).

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

🟡 Changes recommended

Critical build-configuration and white-box call-site issues remain, along with an unresolved DER signature handling case.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR fixes DSA certificate signature length handling by sizing signatures from the public key’s q value and padding ASN.1 components.

Changes:

• Validates DSA q sizes.
• Decodes and zero-pads signature components.
• Adds regression test coverage.

File summaries

File	Summary
wolfcrypt/src/dsa.c	Bounds signature handling by q.
wolfcrypt/src/asn.c	Decodes, sizes, and pads DSA signatures.
tests/api/test_dsa.h	Registers the regression test.
tests/api/test_dsa.c	Adds certificate verification coverage.

Review details

Suppressed comments (3)

wolfcrypt/src/asn.c:17552

• The new test only supplies a malformed 40-byte raw signature and verifies that certificate checking fails, so it never reaches this conversion for a valid ASN.1 DSA-Sig-Value. Consequently, the newly required zero-padding (and the sigCpy + qSz placement for s) is untested; add a valid DER r/s case with at least one component narrower than qSz and assert that verification reaches the expected result, or directly inspect the padded buffer in the white-box test.
  wolfcrypt/src/asn.c:17510
• This helper is decoding the SEQUENCE { INTEGER r, INTEGER s } DSA-Sig-Value after the certificate BIT STRING wrapper has already been removed; it is not parsing an ASN.1 BIT STRING. Please correct the comment so callers do not look for the wrong wire format.
  wolfcrypt/src/asn.c:17917
• Length alone cannot distinguish raw r||s from an ASN.1 DSA-Sig-Value. A valid DER signature can also total exactly 2 * qSz bytes (for example, two 29-byte INTEGERs with a 256-bit q), so this branch will pass the DER bytes directly to wc_DsaVerify() and reject that otherwise valid certificate instead of decoding and padding it. Detect the ASN.1 form or keep the certificate-verification path unconditionally DER-decoding.

• Files reviewed: 4/4 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753