Fix potential overflows in used size calculation in generic, TI and SE050 hash functions.#9954
Conversation
There was a problem hiding this comment.
Pull request overview
Prevents se050_hash_update from proceeding when se050Ctx->used + len would overflow, addressing the reported issue in #9951.
Changes:
- Introduces a safe-add check (
WC_SAFE_SUM_WORD32) before updating the hash state. - Adds a
tmpSzaccumulator to hold the checked sum ofused + len.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
kareem-wolfssl
changed the title
kareem-wolfssl
added
For This Release
|
Retest this please. |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
Thanks to Arjuna Arya for the report. Fixes wolfSSL#9951.
Thanks to Arjuna Arya for the report. Fixes wolfSSL#9955.
… additions. Fixes unused variable warning as well. Fix different type addition in hash.c.
Both _wc_Hash_Grow() and hashUpdate() compute buffer sizes via unchecked addition of used + inSz/len. If used is near UINT32_MAX, the sum wraps to a small value, causing a small allocation followed by a large memcpy — a heap buffer overflow. Fix: use WC_SAFE_SUM_WORD32() to check for overflow before the addition, consistent with the fix applied in wolfSSL#9954 for SE050. Affects: - wolfcrypt/src/hash.c: _wc_Hash_Grow() (WOLFSSL_HASH_KEEP) - wolfcrypt/src/port/ti/ti-hash.c: hashUpdate() (WOLFSSL_TI_HASH) Fixes wolfSSL#9955 Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Description
Fixes #9951.
Thanks to Arjuna Arya for the report.
Testing
Built in tests
Checklist