Skip to content

Commit 4d56cc1

Browse files
SparkiDevSparkiDev
committed
Regression testing: memory allocation failure
Fixes from memory allocation failure testing. Also: fix asn.c to have ifdef protection around code compiled in with dual algorithm certificates. fix test_tls13_rpk_handshake() to support no TLS 1.2 or no TLS 1.3. fix wc_xmss_sigsleft() to initialize the index to avoid compilation error.
1 parent 474b8a0 commit 4d56cc1

9 files changed

Lines changed: 191 additions & 102 deletions

File tree

‎src/crl.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ static int InitCRL_Entry(CRL_Entry* crle, DecodedCRL* dcrl, const byte* buff,
121121
wolfSSL_d2i_X509_NAME(&crle->issuer, (unsigned char**)&dcrl->issuer,
122122
dcrl->issuerSz);
123123
if (crle->issuer == NULL) {
124-
return WOLFSSL_FAILURE;
124+
return -1;
125125
}
126126
#endif
127127
#ifdef CRL_STATIC_REVOKED_LIST

‎src/internal.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13495,6 +13495,9 @@ int SetupStoreCtxCallback(WOLFSSL_X509_STORE_CTX** store_pt,
1349513495
store->current_cert = x509;
1349613496
*x509Free = 1;
1349713497
}
13498+
else {
13499+
goto mem_error;
13500+
}
1349813501
}
1349913502
#endif
1350013503
#ifdef SESSION_CERTS

‎src/ssl.c‎

Lines changed: 19 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -5437,24 +5437,9 @@ int AddCA(WOLFSSL_CERT_MANAGER* cm, DerBuffer** pDer, int type, int verify)
54375437
if (!signer)
54385438
ret = MEMORY_ERROR;
54395439
}
5440-
#if defined(WOLFSSL_AKID_NAME) || defined(HAVE_CRL)
5441-
if (ret == 0 && signer != NULL)
5442-
ret = CalcHashId(cert->serial, cert->serialSz, signer->serialHash);
5443-
#endif
5444-
if (ret == 0 && signer != NULL) {
5445-
#ifdef WOLFSSL_SIGNER_DER_CERT
5446-
ret = AllocDer(&signer->derCert, der->length, der->type, NULL);
5447-
}
5448-
if (ret == 0 && signer != NULL) {
5449-
XMEMCPY(signer->derCert->buffer, der->buffer, der->length);
5450-
#endif
5451-
signer->keyOID = cert->keyOID;
5452-
if (cert->pubKeyStored) {
5453-
signer->publicKey = cert->publicKey;
5454-
signer->pubKeySize = cert->pubKeySize;
5455-
}
54565440

54575441
#ifdef WOLFSSL_DUAL_ALG_CERTS
5442+
if (ret == 0 && signer != NULL) {
54585443
if (cert->extSapkiSet && cert->sapkiLen > 0) {
54595444
/* Allocated space for alternative public key. */
54605445
signer->sapkiDer = (byte*)XMALLOC(cert->sapkiLen, cm->heap,
@@ -5468,8 +5453,26 @@ int AddCA(WOLFSSL_CERT_MANAGER* cm, DerBuffer** pDer, int type, int verify)
54685453
signer->sapkiOID = cert->sapkiOID;
54695454
}
54705455
}
5456+
}
54715457
#endif /* WOLFSSL_DUAL_ALG_CERTS */
54725458

5459+
#if defined(WOLFSSL_AKID_NAME) || defined(HAVE_CRL)
5460+
if (ret == 0 && signer != NULL)
5461+
ret = CalcHashId(cert->serial, cert->serialSz, signer->serialHash);
5462+
#endif
5463+
if (ret == 0 && signer != NULL) {
5464+
#ifdef WOLFSSL_SIGNER_DER_CERT
5465+
ret = AllocDer(&signer->derCert, der->length, der->type, NULL);
5466+
}
5467+
if (ret == 0 && signer != NULL) {
5468+
XMEMCPY(signer->derCert->buffer, der->buffer, der->length);
5469+
#endif
5470+
signer->keyOID = cert->keyOID;
5471+
if (cert->pubKeyStored) {
5472+
signer->publicKey = cert->publicKey;
5473+
signer->pubKeySize = cert->pubKeySize;
5474+
}
5475+
54735476
if (cert->subjectCNStored) {
54745477
signer->nameLen = cert->subjectCNLen;
54755478
signer->name = cert->subjectCN;

‎src/ssl_load.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5202,6 +5202,8 @@ static int wolfssl_set_tmp_dh(WOLFSSL* ssl, unsigned char* p, int pSz,
52025202

52035203
/* Allocate space for cipher suites. */
52045204
if ((ret == 1) && (AllocateSuites(ssl) != 0)) {
5205+
ssl->buffers.serverDH_P.buffer = NULL;
5206+
ssl->buffers.serverDH_G.buffer = NULL;
52055207
ret = 0;
52065208
}
52075209
if (ret == 1) {
@@ -5249,8 +5251,6 @@ int wolfSSL_SetTmpDH(WOLFSSL* ssl, const unsigned char* p, int pSz,
52495251
pAlloc = (byte*)XMALLOC(pSz, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
52505252
gAlloc = (byte*)XMALLOC(gSz, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
52515253
if ((pAlloc == NULL) || (gAlloc == NULL)) {
5252-
XFREE(pAlloc, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
5253-
XFREE(gAlloc, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
52545254
ret = MEMORY_E;
52555255
}
52565256
}

‎src/tls13.c‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9691,6 +9691,7 @@ static void FreeDcv13Args(WOLFSSL* ssl, void* pArgs)
96919691
}
96929692

96939693
#ifdef WOLFSSL_DUAL_ALG_CERTS
9694+
#ifndef NO_RSA
96949695
/* ssl->peerCert->sapkiDer is the alternative public key. Hopefully it is a
96959696
* RSA public key. Convert it into a usable public key. */
96969697
static int decodeRsaKey(WOLFSSL* ssl)
@@ -9714,7 +9715,9 @@ static int decodeRsaKey(WOLFSSL* ssl)
97149715

97159716
return 0;
97169717
}
9718+
#endif /* !NO_RSA */
97179719

9720+
#ifdef HAVE_ECC
97189721
/* ssl->peerCert->sapkiDer is the alternative public key. Hopefully it is a
97199722
* ECC public key. Convert it into a usable public key. */
97209723
static int decodeEccKey(WOLFSSL* ssl)
@@ -9738,7 +9741,9 @@ static int decodeEccKey(WOLFSSL* ssl)
97389741

97399742
return 0;
97409743
}
9744+
#endif /* HAVE_ECC */
97419745

9746+
#ifdef HAVE_DILITHIUM
97429747
/* ssl->peerCert->sapkiDer is the alternative public key. Hopefully it is a
97439748
* dilithium public key. Convert it into a usable public key. */
97449749
static int decodeDilithiumKey(WOLFSSL* ssl, int level)
@@ -9767,7 +9772,9 @@ static int decodeDilithiumKey(WOLFSSL* ssl, int level)
97679772

97689773
return 0;
97699774
}
9775+
#endif /* HAVE_DILITHIUM */
97709776

9777+
#ifdef HAVE_FALCON
97719778
/* ssl->peerCert->sapkiDer is the alternative public key. Hopefully it is a
97729779
* falcon public key. Convert it into a usable public key. */
97739780
static int decodeFalconKey(WOLFSSL* ssl, int level)
@@ -9795,6 +9802,7 @@ static int decodeFalconKey(WOLFSSL* ssl, int level)
97959802

97969803
return 0;
97979804
}
9805+
#endif /* HAVE_FALCON */
97989806
#endif /* WOLFSSL_DUAL_ALG_CERTS */
97999807

98009808
/* handle processing TLS v1.3 certificate_verify (15) */
@@ -9947,12 +9955,17 @@ static int DoTls13CertificateVerify(WOLFSSL* ssl, byte* input,
99479955
sa = args->altSigAlgo;
99489956

99499957
switch(sa) {
9958+
#ifndef NO_RSA
99509959
case rsa_pss_sa_algo:
99519960
ret = decodeRsaKey(ssl);
99529961
break;
9962+
#endif
9963+
#ifdef HAVE_ECC
99539964
case ecc_dsa_sa_algo:
99549965
ret = decodeEccKey(ssl);
99559966
break;
9967+
#endif
9968+
#ifdef HAVE_DILITHIUM
99569969
case dilithium_level2_sa_algo:
99579970
ret = decodeDilithiumKey(ssl, 2);
99589971
break;
@@ -9962,12 +9975,15 @@ static int DoTls13CertificateVerify(WOLFSSL* ssl, byte* input,
99629975
case dilithium_level5_sa_algo:
99639976
ret = decodeDilithiumKey(ssl, 5);
99649977
break;
9978+
#endif
9979+
#ifdef HAVE_FALCON
99659980
case falcon_level1_sa_algo:
99669981
ret = decodeFalconKey(ssl, 1);
99679982
break;
99689983
case falcon_level5_sa_algo:
99699984
ret = decodeFalconKey(ssl, 5);
99709985
break;
9986+
#endif
99719987
default:
99729988
ERROR_OUT(PEER_KEY_ERROR, exit_dcv);
99739989
}
@@ -9978,17 +9994,22 @@ static int DoTls13CertificateVerify(WOLFSSL* ssl, byte* input,
99789994
if (*ssl->sigSpec == WOLFSSL_CKS_SIGSPEC_ALTERNATIVE) {
99799995
/* Now swap in the alternative by removing the native.
99809996
* sa contains the alternative signature type. */
9997+
#ifndef NO_RSA
99819998
if (ssl->peerRsaKeyPresent && sa != rsa_pss_sa_algo) {
99829999
FreeKey(ssl, DYNAMIC_TYPE_RSA,
998310000
(void**)&ssl->peerRsaKey);
998410001
ssl->peerRsaKeyPresent = 0;
998510002
}
10003+
#endif
10004+
#ifdef HAVE_ECC
998610005
else if (ssl->peerEccDsaKeyPresent &&
998710006
sa != ecc_dsa_sa_algo) {
998810007
FreeKey(ssl, DYNAMIC_TYPE_ECC,
998910008
(void**)&ssl->peerEccDsaKey);
999010009
ssl->peerEccDsaKeyPresent = 0;
999110010
}
10011+
#endif
10012+
#ifdef HAVE_DILITHIUM
999210013
else if (ssl->peerDilithiumKeyPresent &&
999310014
sa != dilithium_level2_sa_algo &&
999410015
sa != dilithium_level3_sa_algo &&
@@ -9997,13 +10018,16 @@ static int DoTls13CertificateVerify(WOLFSSL* ssl, byte* input,
999710018
(void**)&ssl->peerDilithiumKey);
999810019
ssl->peerDilithiumKeyPresent = 0;
999910020
}
10021+
#endif
10022+
#ifdef HAVE_FALCON
1000010023
else if (ssl->peerFalconKeyPresent &&
1000110024
sa != falcon_level1_sa_algo &&
1000210025
sa != falcon_level5_sa_algo) {
1000310026
FreeKey(ssl, DYNAMIC_TYPE_FALCON,
1000410027
(void**)&ssl->peerFalconKey);
1000510028
ssl->peerFalconKeyPresent = 0;
1000610029
}
10030+
#endif
1000710031
else {
1000810032
ERROR_OUT(PEER_KEY_ERROR, exit_dcv);
1000910033
}

‎src/x509.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12852,6 +12852,7 @@ WOLF_STACK_OF(WOLFSSL_X509_NAME) *wolfSSL_dup_CA_list(
1285212852
if (name == NULL || WOLFSSL_SUCCESS != wolfSSL_sk_X509_NAME_push(copy, name)) {
1285312853
WOLFSSL_MSG("Memory error");
1285412854
wolfSSL_sk_X509_NAME_pop_free(copy, wolfSSL_X509_NAME_free);
12855+
wolfSSL_X509_NAME_free(name);
1285512856
return NULL;
1285612857
}
1285712858
}

0 commit comments

Comments
 (0)