Bounds and input-validation hardening across ECC, PKCS#7, EVP, TLS 1.2 and ECH

doc/dox_comments/header_files/evp.h

@@ -229,15 +229,16 @@ int  wolfSSL_EVP_DecryptInit_ex(WOLFSSL_EVP_CIPHER_CTX* ctx,
     \return SSL_FAILURE If not successful.
 
     \param ctx structure to get cipher type from.
-    \param out buffer to hold output.
+    \param out buffer to hold output, at least inl plus the cipher block size
+    bytes. It must not overlap in.
     \param outl adjusted to be size of output.
     \param in buffer to perform operation on.
     \param inl length of input buffer.
 
     _Example_
     \code
     WOLFSSL_EVP_CIPHER_CTX* ctx = NULL;
-    unsigned char out[100];
+    unsigned char out[100 + EVP_MAX_BLOCK_LENGTH];
     int outl;
     unsigned char in[100];
     int inl = 100;

src/internal.c

@@ -34539,6 +34539,35 @@ static void MakePSKPreMasterSecret(Arrays* arrays, byte use_psk_key)
 }
 #endif
 
+#if defined(WOLFSSL_TLS13) && \
+    ((!defined(NO_WOLFSSL_CLIENT) && !defined(NO_TLS) && \
+      !defined(WOLFSSL_NO_TLS12)) || \
+     (!defined(NO_WOLFSSL_SERVER) && !defined(NO_TLS)))
+/* Is this one of the cipher suites that can only be negotiated at TLS 1.3? */
+static int IsTls13OnlySuite(byte first, byte second)
+{
+    (void)second;
+
+    if (first == TLS13_BYTE)
+        return 1;
+
+#ifdef HAVE_NULL_CIPHER
+    if ((first == ECC_BYTE) && ((second == TLS_SHA256_SHA256) ||
+                                (second == TLS_SHA384_SHA384)))
+        return 1;
+#endif
+
+#if (defined(WOLFSSL_SM4_GCM) || defined(WOLFSSL_SM4_CCM)) && \
+     defined(WOLFSSL_SM3)
+    if ((first == CIPHER_BYTE) && ((second == TLS_SM4_GCM_SM3) ||
+                                   (second == TLS_SM4_CCM_SM3)))
+        return 1;
+#endif
+
+    return 0;
+}
+#endif
+
 /* client only parts */
 #if !defined(NO_WOLFSSL_CLIENT) && !defined(NO_TLS)
 
@@ -34568,6 +34597,10 @@ static void MakePSKPreMasterSecret(Arrays* arrays, byte use_psk_key)
         int                ret;
         word32             extSz = 0;
         const Suites*      suites;
+        word16             suiteSz;
+#ifdef WOLFSSL_TLS13
+        word16             i;
+#endif
 
         if (ssl == NULL) {
             return BAD_FUNC_ARG;
@@ -34608,6 +34641,22 @@ static void MakePSKPreMasterSecret(Arrays* arrays, byte use_psk_key)
             return SUITES_ERROR;
         }
 
+#ifdef WOLFSSL_TLS13
+        /* Reached only below TLS 1.3, where a TLS 1.3 suite the server picked
+         * from the list could not be used to derive keys. */
+        suiteSz = 0;
+        for (i = 0; i + SUITE_LEN <= suites->suiteSz; i += SUITE_LEN) {
+            if (!IsTls13OnlySuite(suites->suites[i], suites->suites[i + 1]))
+                suiteSz += SUITE_LEN;
+        }
+        if (suiteSz == 0) {
+            WOLFSSL_MSG("No cipher suite valid for version in ClientHello");
+            return SUITES_ERROR;
+        }
+#else
+        suiteSz = suites->suiteSz;
+#endif
+
 #ifdef HAVE_SESSION_TICKET
         if (ssl->options.resuming && ssl->session->ticketLen > 0) {
             SessionTicket* ticket;
@@ -34636,7 +34685,7 @@ static void MakePSKPreMasterSecret(Arrays* arrays, byte use_psk_key)
             length += SUITE_LEN;
         else
 #endif
-            length += suites->suiteSz;
+            length += suiteSz;
 
 #ifdef HAVE_TLS_EXTENSIONS
         /* auto populate extensions supported unless user defined */
@@ -34742,10 +34791,19 @@ static void MakePSKPreMasterSecret(Arrays* arrays, byte use_psk_key)
 #endif /* NO_FORCE_SCR_SAME_SUITE */
         {
             /* then cipher suites */
-            c16toa(suites->suiteSz, output + idx);
+            c16toa(suiteSz, output + idx);
             idx += OPAQUE16_LEN;
-            XMEMCPY(output + idx, &suites->suites, suites->suiteSz);
-            idx += suites->suiteSz;
+#ifdef WOLFSSL_TLS13
+            for (i = 0; i + SUITE_LEN <= suites->suiteSz; i += SUITE_LEN) {
+                if (IsTls13OnlySuite(suites->suites[i], suites->suites[i + 1]))
+                    continue;
+                output[idx++] = suites->suites[i];
+                output[idx++] = suites->suites[i + 1];
+            }
+#else
+            XMEMCPY(output + idx, &suites->suites, suiteSz);
+            idx += suiteSz;
+#endif
         }
 
         /* last, compression.  RFC 5246 7.4.1.2 requires the list to always
@@ -40773,37 +40831,6 @@ static int AddPSKtoPreMasterSecret(WOLFSSL* ssl)
 
 #endif /* !WOLFSSL_NO_TLS12 */
 
-#ifdef WOLFSSL_TLS13
-    /* Check if a cipher suite is a TLS 1.3 cipher suite
-     * Returns 1 if TLS 1.3 cipher suite, 0 otherwise
-     */
-    static WC_INLINE int IsTls13CipherSuite(byte first, byte second)
-    {
-        (void)second;  /* Suppress unused parameter warning */
-
-        /* TLS 1.3 cipher suites use TLS13_BYTE (0x13) as first byte */
-        if (first == TLS13_BYTE)
-            return 1;
-
-#ifdef HAVE_NULL_CIPHER
-        /* Special cases for integrity-only cipher suites */
-        if (first == ECC_BYTE && (second == TLS_SHA256_SHA256 ||
-                                  second == TLS_SHA384_SHA384))
-            return 1;
-#endif
-
-#if (defined(WOLFSSL_SM4_GCM) || defined(WOLFSSL_SM4_CCM)) && \
-     defined(WOLFSSL_SM3)
-        /* SM4 cipher suites for TLS 1.3 */
-        if (first == CIPHER_BYTE && (second == TLS_SM4_GCM_SM3 ||
-                                     second == TLS_SM4_CCM_SM3))
-            return 1;
-#endif
-
-        return 0;
-    }
-#endif /* WOLFSSL_TLS13 */
-
     /* Make sure server cert/key are valid for this suite, true on success
      * Returns 1 for valid server suite or 0 if not found
      * For asynchronous this can return WC_PENDING_E
@@ -40834,7 +40861,7 @@ static int AddPSKtoPreMasterSecret(WOLFSSL* ssl)
         /* When negotiating TLS 1.3, reject non-TLS 1.3 cipher suites */
         if (IsAtLeastTLSv1_3(ssl->version) &&
             ssl->options.side == WOLFSSL_SERVER_END) {
-            if (!IsTls13CipherSuite(first, second)) {
+            if (!IsTls13OnlySuite(first, second)) {
                 WOLFSSL_MSG("TLS 1.2 cipher suite not valid for TLS 1.3");
                 return 0;
             }
@@ -40944,11 +40971,7 @@ static int AddPSKtoPreMasterSecret(WOLFSSL* ssl)
                 return 0; /* not found */
     #endif /* HAVE_SUPPORTED_CURVES */
         }
-        else if ((first == TLS13_BYTE) || ((first == ECC_BYTE) &&
-                 ((second == TLS_SHA256_SHA256) ||
-                  (second == TLS_SHA384_SHA384))) ||
-                 ((first == CIPHER_BYTE) && ((second == TLS_SM4_GCM_SM3) ||
-                  (second == TLS_SM4_CCM_SM3)))) {
+        else if (IsTls13OnlySuite(first, second)) {
             /* Can't negotiate TLS 1.3 cipher suites with lower protocol
              * version. */
             return 0;

src/keys.c

@@ -50,6 +50,18 @@ int SetCipherSpecs(WOLFSSL* ssl)
                                 ssl->options.cipherSuite, &ssl->specs,
                                 &ssl->options);
     if (ret == 0) {
+    #ifdef WOLFSSL_TLS13
+        /* The client only checks that the ServerHello suite was offered, and
+         * the TLS 1.2 key block of TLS_SHA384_SHA384 exceeds MAX_PRF_DIG. */
+        if (ssl->specs.kea == any_kea && !IsAtLeastTLSv1_3(ssl->version)) {
+            WOLFSSL_MSG("TLS 1.3 cipher suite not valid for lower version");
+            WOLFSSL_ERROR_VERBOSE(UNSUPPORTED_SUITE);
+            /* GetCipherSpec already wrote the rejected suite's sizes. */
+            XMEMSET(&ssl->specs, 0, sizeof(ssl->specs));
+            return UNSUPPORTED_SUITE;
+        }
+    #endif /* WOLFSSL_TLS13 */
+
     #ifdef WOLFSSL_ALLOW_SSLV3
          /* SSLv3 (RFC 6101) defines MAC algorithms as MD5 and SHA-1. SHA-256
           * was introduced in TLS 1.2 (RFC 5246). SSL_hmac for old SSLv3

src/pk_ec.c

@@ -1249,6 +1249,17 @@ char* wolfSSL_EC_POINT_point2hex(const WOLFSSL_EC_GROUP* group,
             err = 1;
         }
     }
+    /* A point that has never been set carries NULL ordinates. */
+    if ((!err) && ((point->X == NULL) || (point->Y == NULL) ||
+            (point->X->internal == NULL) || (point->Y->internal == NULL))) {
+        err = 1;
+    }
+    /* Ordinates wider than the curve would make the offsets below negative. */
+    if ((!err) &&
+            ((mp_unsigned_bin_size((mp_int*)point->X->internal) > sz) ||
+             (mp_unsigned_bin_size((mp_int*)point->Y->internal) > sz))) {
+        err = 1;
+    }
     if (!err) {
         /* <format byte> <x-ordinate> [<y-ordinate>] */
         len = sz + 1;

src/tls.c

@@ -563,6 +563,12 @@ int DeriveTlsKeys(WOLFSSL* ssl)
                         2 * ssl->specs.iv_size;
     WC_DECLARE_VAR(key_dig, byte, MAX_PRF_DIG, 0);
 
+    if (key_dig_len <= 0 || key_dig_len > MAX_PRF_DIG) {
+        WOLFSSL_MSG("Key block too large for PRF digest buffer");
+        WOLFSSL_ERROR_VERBOSE(BUFFER_E);
+        return BUFFER_E;
+    }
+
     WC_ALLOC_VAR_EX(key_dig, byte, MAX_PRF_DIG, ssl->heap,
         DYNAMIC_TYPE_DIGEST, return MEMORY_E);
 

src/tls13.c

@@ -4123,7 +4123,17 @@ static int EchCalcAcceptance(WOLFSSL* ssl, byte* label, word16 labelSz,
     headerSz = HANDSHAKE_HEADER_SZ;
 #endif
 
-    if (isHrr) {
+    /* input starts at the handshake header, so the confirmation bytes must lie
+     * inside the message that follows it */
+    if (acceptOffset < headerSz || helloSz < 0 ||
+            (helloSz + headerSz) < ECH_ACCEPT_CONFIRMATION_SZ ||
+            acceptOffset > (helloSz + headerSz) -
+                ECH_ACCEPT_CONFIRMATION_SZ) {
+        WOLFSSL_ERROR_VERBOSE(BUFFER_ERROR);
+        ret = BUFFER_ERROR;
+    }
+
+    if (ret == 0 && isHrr) {
         /* the transcript hash of ClientHelloInner1 */
         ret = GetMsgHash(ssl, clientHelloInnerHash);
         if (ret > 0) {
@@ -6176,21 +6186,32 @@ int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
                 return ret;
         }
         else {
+            const byte* hsMsg;
+            int acceptOffset;
+            word32 headerSz = HANDSHAKE_HEADER_SZ;
+        #ifdef WOLFSSL_DTLS13
+            if (ssl->options.dtls)
+                headerSz = DTLS13_HANDSHAKE_HEADER_SZ;
+        #endif
+            /* EchCheckAcceptance hashes from the handshake header, which
+             * always precedes input + args->begin (cf. HashInput) */
+            hsMsg = input + args->begin - headerSz;
             /* account for hrr extension instead of server random */
             if (args->extMsgType == hello_retry_request) {
-                args->acceptOffset =
-                    (word32)(((WOLFSSL_ECH*)args->echX->data)->confBuf - input);
+                acceptOffset =
+                    (int)(((WOLFSSL_ECH*)args->echX->data)->confBuf - hsMsg);
                 args->acceptLabel = (byte*)echHrrAcceptConfirmationLabel;
                 args->acceptLabelSz = ECH_HRR_ACCEPT_CONFIRMATION_LABEL_SZ;
             }
             else {
+                acceptOffset = (int)(input + args->acceptOffset - hsMsg);
                 args->acceptLabel = (byte*)echAcceptConfirmationLabel;
                 args->acceptLabelSz = ECH_ACCEPT_CONFIRMATION_LABEL_SZ;
             }
             /* check acceptance */
             if (ret == 0) {
                 ret = EchCheckAcceptance(ssl, args->acceptLabel,
-                    args->acceptLabelSz, input, args->acceptOffset, helloSz,
+                    args->acceptLabelSz, hsMsg, acceptOffset, helloSz,
                     args->extMsgType);
             }
             if (ret != 0)