Skip to content

Commit 1e84d24

Browse files
committed
SM2 named curve disabled: value outside of supported values
SM2 named curve value is specified in specification. Values 0-14 aren't used, so, those bits in disabledCurves are used for values over 31. Add range checks.
1 parent 3943852 commit 1e84d24

3 files changed

Lines changed: 29 additions & 13 deletions

File tree

src/ssl.c

Lines changed: 24 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -32491,9 +32491,20 @@ void wolfSSL_get0_next_proto_negotiated(const WOLFSSL *s, const unsigned char **
3249132491
#if defined(OPENSSL_EXTRA) || defined(HAVE_CURL)
3249232492
int wolfSSL_curve_is_disabled(const WOLFSSL* ssl, word16 curve_id)
3249332493
{
32494-
return (curve_id <= WOLFSSL_ECC_MAX &&
32495-
ssl->disabledCurves &&
32496-
ssl->disabledCurves & (1 << curve_id));
32494+
if (curve_id >= WOLFSSL_FFDHE_START) {
32495+
/* DH parameters are never disabled. */
32496+
return 0;
32497+
}
32498+
if (curve_id > WOLFSSL_ECC_MAX_AVAIL) {
32499+
WOLFSSL_MSG("Curve id out of supported range");
32500+
/* Disabled if not in valid range. */
32501+
return 1;
32502+
}
32503+
if (curve_id >= 32) {
32504+
/* 0 is for invalid and 1-14 aren't used otherwise. */
32505+
return (ssl->disabledCurves & (1 << (curve_id - 32))) != 0;
32506+
}
32507+
return (ssl->disabledCurves & (1 << curve_id)) != 0;
3249732508
}
3249832509

3249932510
#if (defined(HAVE_ECC) || \
@@ -32553,7 +32564,7 @@ static int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, const char* names)
3255332564
else if ((XSTRNCMP(name, "sm2p256v1", len) == 0) ||
3255432565
(XSTRNCMP(name, "SM2", len) == 0))
3255532566
{
32556-
curve = WOLFSSL_ECC_SECP521R1;
32567+
curve = WOLFSSL_ECC_SM2P256V1;
3255732568
}
3255832569
#endif
3255932570
#ifdef HAVE_CURVE25519
@@ -32592,10 +32603,8 @@ static int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, const char* names)
3259232603
#endif
3259332604
}
3259432605

32595-
if (curve >= (sizeof(word32) * WOLFSSL_BIT_SIZE)) {
32596-
/* shift left more than size of ctx->disabledCurves causes static
32597-
* analysis report */
32598-
WOLFSSL_MSG("curve value is too large for upcoming shift");
32606+
if (curve >= WOLFSSL_ECC_MAX_AVAIL) {
32607+
WOLFSSL_MSG("curve value is not supported");
3259932608
goto leave;
3260032609
}
3260132610

@@ -32622,7 +32631,13 @@ static int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, const char* names)
3262232631
for (i = 0; i < groups_len; ++i) {
3262332632
/* Switch the bit to off and therefore is enabled. */
3262432633
curve = (word16)groups[i];
32625-
disabled &= ~(1U << curve);
32634+
if (curve >= 32) {
32635+
/* 0 is for invalid and 1-14 aren't used otherwise. */
32636+
disabled &= ~(1U << (curve - 32));
32637+
}
32638+
else {
32639+
disabled &= ~(1U << curve);
32640+
}
3262632641
#ifdef HAVE_SUPPORTED_CURVES
3262732642
#if defined(WOLFSSL_TLS13) && !defined(WOLFSSL_OLD_SET_CURVES_LIST)
3262832643
/* using the wolfSSL API to set the groups, this will populate

src/tls.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4705,8 +4705,7 @@ int TLSX_ValidateSupportedCurves(const WOLFSSL* ssl, byte first, byte second,
47054705
#ifdef OPENSSL_EXTRA
47064706
/* skip if name is not in supported ECC range
47074707
* or disabled by user */
4708-
if (curve->name > WOLFSSL_ECC_MAX ||
4709-
wolfSSL_curve_is_disabled(ssl, curve->name))
4708+
if (wolfSSL_curve_is_disabled(ssl, curve->name))
47104709
continue;
47114710
#endif
47124711

@@ -8651,8 +8650,7 @@ static int TLSX_SupportedGroups_Find(const WOLFSSL* ssl, word16 name,
86518650
TLSX* extension;
86528651
SupportedCurve* curve = NULL;
86538652

8654-
if ((extension = TLSX_Find(extensions,
8655-
TLSX_SUPPORTED_GROUPS)) == NULL) {
8653+
if ((extension = TLSX_Find(extensions, TLSX_SUPPORTED_GROUPS)) == NULL) {
86568654
if ((extension = TLSX_Find(ssl->ctx->extensions,
86578655
TLSX_SUPPORTED_GROUPS)) == NULL) {
86588656
return 0;

wolfssl/ssl.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3926,7 +3926,10 @@ enum {
39263926
WOLFSSL_ECC_X448 = 30,
39273927
WOLFSSL_ECC_SM2P256V1 = 41,
39283928
WOLFSSL_ECC_MAX = 41,
3929+
WOLFSSL_ECC_MAX_AVAIL = 46,
3930+
/* Update use of disabled curves when adding value greater than 46. */
39293931

3932+
WOLFSSL_FFDHE_START = 256,
39303933
WOLFSSL_FFDHE_2048 = 256,
39313934
WOLFSSL_FFDHE_3072 = 257,
39323935
WOLFSSL_FFDHE_4096 = 258,

0 commit comments

Comments
 (0)