Skip to content

Fix potential overflows in used size calculation in generic, TI and SE050 hash functions.#9954

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dgarske merged 6 commits into from
Mar 16, 2026
Merged

Fix potential overflows in used size calculation in generic, TI and SE050 hash functions. #9954

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
091016a
Ensure se050Ctx->used does not overflow in se050_hash_update.
kareem-wolfssl Mar 11, 2026
d205fca
Fix potential overflows in two additional hash functions.
kareem-wolfssl Mar 12, 2026
42b321a
Use safe sum of used size after calculating it. No reason to redo th…
kareem-wolfssl Mar 12, 2026
0a082b0
Code review feedback
kareem-wolfssl Mar 12, 2026
3cc1554
Code review feedback. Error out on len = 0 as well.
kareem-wolfssl Mar 13, 2026
0b26791
Code review feedback
kareem-wolfssl Mar 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions wolfcrypt/src/hash.c
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -1954,12 +1954,17 @@ int wc_HashGetFlags(wc_HashAlg* hash, enum wc_HashType type, word32* flags)
int _wc_Hash_Grow(byte** msg, word32* used, word32* len, const byte* in,
int inSz, void* heap)
{
if (*len < *used + inSz) {
word32 usedSz = 0;

if (inSz <= 0 || !WC_SAFE_SUM_WORD32(*used, (word32)inSz, usedSz))
Comment thread
kareem-wolfssl marked this conversation as resolved.
return BAD_FUNC_ARG;

if (*len < usedSz) {
Comment thread
kareem-wolfssl marked this conversation as resolved.
if (*msg == NULL) {
*msg = (byte*)XMALLOC(*used + inSz, heap, DYNAMIC_TYPE_TMP_BUFFER);
*msg = (byte*)XMALLOC(usedSz, heap, DYNAMIC_TYPE_TMP_BUFFER);
}
else {
byte* pt = (byte*)XREALLOC(*msg, *used + inSz, heap,
byte* pt = (byte*)XREALLOC(*msg, usedSz, heap,
DYNAMIC_TYPE_TMP_BUFFER);
if (pt == NULL) {
return MEMORY_E;
Expand All@@ -1969,7 +1974,7 @@ int _wc_Hash_Grow(byte** msg, word32* used, word32* len, const byte* in,
if (*msg == NULL) {
return MEMORY_E;
}
*len = *used + inSz;
*len = usedSz;
}
XMEMCPY(*msg + *used, in, inSz);
*used += inSz;
Expand Down
21 changes: 13 additions & 8 deletions wolfcrypt/src/port/nxp/se050_port.c
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -266,33 +266,38 @@ int se050_hash_copy(SE050_HASH_Context* src, SE050_HASH_Context* dst)

int se050_hash_update(SE050_HASH_Context* se050Ctx, const byte* data, word32 len)
{
byte* tmp = NULL;
byte* tmp = NULL;
word32 usedSz = 0;

if (se050Ctx == NULL || (len > 0 && data == NULL)) {
if (se050Ctx == NULL || (len > 0 && data == NULL) || (len == 0) ||
Comment thread
kareem-wolfssl marked this conversation as resolved.
!WC_SAFE_SUM_WORD32(se050Ctx->used, len, usedSz)) {
return BAD_FUNC_ARG;
}

if (se050Ctx->len < se050Ctx->used + len) {
if (se050Ctx->len < usedSz) {
if (se050Ctx->msg == NULL) {
se050Ctx->msg = (byte*)XMALLOC(se050Ctx->used + len,
se050Ctx->msg = (byte*)XMALLOC(usedSz,
se050Ctx->heap, DYNAMIC_TYPE_TMP_BUFFER);
XMEMSET(se050Ctx->msg, 0, se050Ctx->used + len);
if (se050Ctx->msg == NULL) {
return MEMORY_E;
}
XMEMSET(se050Ctx->msg, 0, usedSz);
}
else {
tmp = (byte*)XMALLOC(se050Ctx->used + len, se050Ctx->heap,
tmp = (byte*)XMALLOC(usedSz, se050Ctx->heap,
DYNAMIC_TYPE_TMP_BUFFER);
if (tmp == NULL) {
return MEMORY_E;
}
XMEMSET(tmp, 0, se050Ctx->used + len);
XMEMSET(tmp, 0, usedSz);
XMEMCPY(tmp, se050Ctx->msg, se050Ctx->used);
XFREE(se050Ctx->msg, se050Ctx->heap, DYNAMIC_TYPE_TMP_BUFFER);
se050Ctx->msg = tmp;
}
if (se050Ctx->msg == NULL) {
return MEMORY_E;
}
se050Ctx->len = se050Ctx->used + len;
se050Ctx->len = usedSz;
Comment thread
kareem-wolfssl marked this conversation as resolved.
}

XMEMCPY(se050Ctx->msg + se050Ctx->used, data, len);
Comment thread
kareem-wolfssl marked this conversation as resolved.
Expand Down
16 changes: 10 additions & 6 deletions wolfcrypt/src/port/ti/ti-hash.c
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -75,18 +75,22 @@ static int hashInit(wolfssl_TI_Hash *hash)
static int hashUpdate(wolfssl_TI_Hash *hash, const byte* data, word32 len)
{
void *p;
word32 usedSz = 0;

if ((hash== NULL) || (data == NULL))return BAD_FUNC_ARG;
if ((hash == NULL) || (data == NULL) || (len == 0) ||
!WC_SAFE_SUM_WORD32(hash->used, len, usedSz))
return BAD_FUNC_ARG;

Comment thread
kareem-wolfssl marked this conversation as resolved.
if (hash->len < hash->used+len) {
if (hash->len < usedSz) {
if (hash->msg == NULL) {
p = XMALLOC(hash->used+len, NULL, DYNAMIC_TYPE_TMP_BUFFER);
p = XMALLOC(usedSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
} else {
p = XREALLOC(hash->msg, hash->used+len, NULL, DYNAMIC_TYPE_TMP_BUFFER);
p = XREALLOC(hash->msg, usedSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
}
if (p == 0)return 1;
if (p == 0)
return MEMORY_E;
hash->msg = p;
hash->len = hash->used+len;
hash->len = usedSz;
}
XMEMCPY(hash->msg+hash->used, data, len);
Comment thread
kareem-wolfssl marked this conversation as resolved.
hash->used += len;
Expand Down
Loading