Fix: WolfCrypt Fenrir - 12 fixes

doc/dox_comments/header_files/sha256.h

@@ -366,11 +366,11 @@ int wc_Sha256_Grow(wc_Sha256* sha256, const byte* in, int inSz);
     \return negative on error
 
     \param src Source SHA256 structure
-    \param dst Destination SHA256 structure
+    \param dst Destination SHA256 structure; must be zeroed/initialized
 
     _Example_
     \code
-    wc_Sha256 src, dst;
+    wc_Sha256 src, dst = {0};
     int ret = wc_Sha256Copy(&src, &dst);
     \endcode
 

tests/api/test_aes.c

@@ -3260,13 +3260,15 @@ int test_wc_AesGcmEncryptDecrypt_Sizes(void)
     int sz;
     int i;
     WC_DECLARE_VAR(plain, byte, GCM_LEN, NULL);
-    WC_DECLARE_VAR(cipher, byte, GCM_LEN, NULL);
+    /* enlarged size is to accommodate devcrypto build which assumes
+     * space in buffer to append auth tag */
+    WC_DECLARE_VAR(cipher, byte, GCM_LEN+WC_AES_BLOCK_SIZE, NULL);
 #ifdef HAVE_AES_DECRYPT
     WC_DECLARE_VAR(decrypted, byte, GCM_LEN, NULL);
 #endif
 
     WC_ALLOC_VAR(plain, byte, GCM_LEN, NULL);
-    WC_ALLOC_VAR(cipher, byte, GCM_LEN, NULL);
+    WC_ALLOC_VAR(cipher, byte, GCM_LEN+WC_AES_BLOCK_SIZE, NULL);
 #ifdef HAVE_AES_DECRYPT
     WC_ALLOC_VAR(decrypted, byte, GCM_LEN, NULL);
 #endif
@@ -3286,7 +3288,7 @@ int test_wc_AesGcmEncryptDecrypt_Sizes(void)
 
     ExpectIntEQ(wc_AesGcmSetKey(&aes, key32, sizeof(key32)/sizeof(byte)), 0);
     for (sz = 0; sz < WC_AES_BLOCK_SIZE; sz++) {
-        XMEMSET(cipher, 0, GCM_LEN);
+        XMEMSET(cipher, 0, GCM_LEN + WC_AES_BLOCK_SIZE);
         ExpectIntEQ(wc_AesGcmEncrypt(&aes, cipher, plain, sz, iv, ivLen, tag,
             sizeof(tag), NULL, 0), 0);
         ExpectBufEQ(cipher, expected, sz);
@@ -3302,7 +3304,7 @@ int test_wc_AesGcmEncryptDecrypt_Sizes(void)
 
     i = 0;
     for (sz = WC_AES_BLOCK_SIZE; sz <= GCM_LEN; sz *= 2) {
-        XMEMSET(cipher, 0, GCM_LEN);
+        XMEMSET(cipher, 0, GCM_LEN + WC_AES_BLOCK_SIZE);
         ExpectIntEQ(wc_AesGcmEncrypt(&aes, cipher, plain, sz, iv, ivLen, tag,
             sizeof(tag), NULL, 0), 0);
         ExpectBufEQ(tag, expTagLong[i], WC_AES_BLOCK_SIZE);
@@ -3991,7 +3993,9 @@ int test_wc_AesGcmNonStdNonce(void)
  * and cannot exercise the GHASH-based counter derivation. */
 #if !defined(NO_AES) && defined(HAVE_AESGCM) && \
     !defined(HAVE_FIPS) && \
-    !defined(WOLFSSL_AFALG) && !defined(WOLFSSL_KCAPI)
+    !defined(WOLFSSL_AFALG) && !defined(WOLFSSL_KCAPI) && \
+    !defined(WOLFSSL_DEVCRYPTO_AES)
+    /* DEVCRYPTO does not support Non std Nonce */
 
     /* ------------------------------------------------------------------
      * Section 1: 1-byte IV, AES-128

wolfcrypt/src/aes.c

@@ -5848,7 +5848,8 @@ static void AesSetKey_C(Aes* aes, const byte* key, word32 keySz, int dir)
 
     #if defined(WOLFSSL_DEVCRYPTO) && \
         (defined(WOLFSSL_DEVCRYPTO_AES) || defined(WOLFSSL_DEVCRYPTO_CBC))
-        aes->ctx.cfd = -1;
+        aes->ctx.inited = 0;
+        aes->ctx.cfd    = -1;
     #endif
     #ifdef WOLFSSL_IMX6_CAAM_BLOB
         ForceZero(local, sizeof(local));
@@ -14891,7 +14892,8 @@ int wc_AesInit(Aes* aes, void* heap, int devId)
 #endif
 #if defined(WOLFSSL_DEVCRYPTO) && \
    (defined(WOLFSSL_DEVCRYPTO_AES) || defined(WOLFSSL_DEVCRYPTO_CBC))
-    aes->ctx.cfd = -1;
+    aes->ctx.inited = 0;
+    aes->ctx.cfd    = -1;
 #endif
 #if defined(WOLFSSL_IMXRT_DCP)
     DCPAesInit(aes);

wolfcrypt/src/des3.c

@@ -1570,11 +1570,15 @@
                           pc1m[(l = j + totrot[i]) < (j < 28 ? 28 : 56) ? l : l-28];
 
                 /* rotate left and right halves independently */
-                for (j = 0; j < 48; j++) {        /* select bits individually     */
-                    if (pcr[pc2[j] - 1]) {        /* check bit that goes to ks[j] */
-                        l= j % 6;                 /* mask it in if it's there     */
-                        ks[j/6] |= (byte)(bytebit[l] >> 2);
-                    }
+                for (j = 0; j < 48; j++) { /* select bits individually */
+                    byte bit;
+                    byte mask;
+                    bit =
+                        (byte)(pcr[pc2[j] - 1]); /* all pcr values are either 0 or 1 */
+                    mask = (byte)(0 - bit);   /* mask is either 0xFF or 0x00 */
+                    /* only set to bytebit value if bit == 1 */
+                    ks[j/6] |=
+                        (byte)((bytebit[j % 6] >> 2) & mask);
                 }
 
                 /* Now convert to odd/even interleaved form for use in F */

wolfcrypt/src/dsa.c

@@ -1128,6 +1128,13 @@ int wc_DsaVerify_ex(const byte* digest, word32 digestSz, const byte* sig,
     if (digest == NULL || sig == NULL || key == NULL || answer == NULL)
         return BAD_FUNC_ARG;
 
+    /* assign default value so verification is always failed on error */
+    *answer = 0;
+
+    /* Note the min allowed digestSz here is WC_SHA_DIGEST_SIZE, not
+     * WC_MIN_DIGEST_SIZE, to allow verify-only legacy DSA operations, as
+     * expressly allowed under FIPS 186-5, FIPS 140-3, and SP 800-131A.
+     */
     if ((digestSz > WC_MAX_DIGEST_SIZE) ||
         (digestSz < WC_MIN_DIGEST_SIZE_FOR_VERIFY))
     {

wolfcrypt/src/ecc.c

@@ -10401,7 +10401,7 @@ static int _ecc_export_x963(ecc_key* key, byte* out, word32* outLen)
         /* store byte point type */
         out[0] = ECC_POINT_UNCOMP;
 
-        if (caamReadPartition((CAAM_ADDRESS)key->securePubKey, out+1, keySz*2) != 0)
+        if (caamReadPartition(key->securePubKey, out+1, keySz*2) != 0)
             return WC_HW_E;
 
         *outLen = 1 + 2*keySz;
@@ -12024,15 +12024,15 @@ static int _ecc_import_private_key_ex(const byte* priv, word32 privSz,
             }
 
             key->partNum  = part;
-            key->blackKey = (word32)vaddr;
+            key->blackKey = vaddr;
             if (caamWriteToPartition(vaddr, priv, privSz) != 0)
                 return WC_HW_E;
 
             if (pub != NULL) {
                 /* +1 to account for x963 compressed bit */
                 if (caamWriteToPartition(vaddr + privSz, pub + 1, pubSz - 1) != 0)
                     return WC_HW_E;
-                key->securePubKey = (word32)vaddr + privSz;
+                key->securePubKey = vaddr + privSz;
             }
         }
         else {

wolfcrypt/src/hmac.c

@@ -1519,7 +1519,8 @@ int wc_HmacInit(Hmac* hmac, void* heap, int devId)
     hmac->devCtx = NULL;
 #endif
 #if defined(WOLFSSL_DEVCRYPTO_HMAC)
-    hmac->ctx.cfd = -1;
+    hmac->ctx.inited = 0;
+    hmac->ctx.cfd    = -1;
 #endif
 
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_HMAC)

wolfcrypt/src/port/Espressif/esp_crt_bundle/esp_crt_bundle.c

@@ -983,14 +983,12 @@ static CB_INLINE int wolfssl_ssl_conf_verify_cb_no_signer(int preverify,
     /* Clean up and exit */
     if ((_crt_found == 0) && (bundle_cert != NULL)) {
         ESP_LOGW(TAG, "Cert not found, free bundle_cert");
+        /* this_subject and this_issuer are a part of bundle_cert and will be
+         * freed here*/
         wolfSSL_X509_free(bundle_cert);
         bundle_cert = NULL;
-        /* this_subject and this_issuer are pointers into cert used.
-         * Don't free if the cert was found. */
-        wolfSSL_X509_NAME_free(this_subject);
-        this_subject = NULL;
-        wolfSSL_X509_NAME_free(this_issuer);
         this_issuer = NULL;
+        this_subject = NULL;
     }
 
     /* We don't clean up the store_cert and x509 as we are in a callback,

wolfcrypt/src/port/Renesas/renesas_fspsm_aes.c

@@ -410,10 +410,13 @@ int  wc_fspsm_AesGcmEncrypt(struct Aes* aes, byte* out,
                                             aes->heap, DYNAMIC_TYPE_AES);
             key_server_aes = (FSPSM_AES_PWKEY)XMALLOC(sizeof(FSPSM_AES_WKEY),
                                             aes->heap, DYNAMIC_TYPE_AES);
-            if (key_client_aes == NULL || key_server_aes == NULL) {
-                XFREE(plainBuf,  aes->heap, DYNAMIC_TYPE_AES);
-                XFREE(cipherBuf, aes->heap, DYNAMIC_TYPE_AES);
-                XFREE(aTagBuf,   aes->heap, DYNAMIC_TYPE_AES);
+            if (key_server_aes == NULL || key_client_aes == NULL) {
+                XFREE(key_client_aes,  aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(key_server_aes,  aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(plainBuf,       aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(cipherBuf,      aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(aTagBuf,        aes->heap, DYNAMIC_TYPE_AES);
+                wc_fspsm_hw_unlock();
                 return MEMORY_E;
             }
 
@@ -638,9 +641,12 @@ int  wc_fspsm_AesGcmDecrypt(struct Aes* aes, byte* out,
             key_server_aes = (FSPSM_AES_PWKEY)XMALLOC(sizeof(FSPSM_AES_WKEY),
                                             aes->heap, DYNAMIC_TYPE_AES);
             if (key_client_aes == NULL || key_server_aes == NULL) {
-                XFREE(plainBuf,  aes->heap, DYNAMIC_TYPE_AES);
-                XFREE(cipherBuf, aes->heap, DYNAMIC_TYPE_AES);
-                XFREE(aTagBuf,   aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(key_client_aes,  aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(key_server_aes,  aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(plainBuf,        aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(cipherBuf,       aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(aTagBuf,         aes->heap, DYNAMIC_TYPE_AES);
+                wc_fspsm_hw_unlock();
                 return MEMORY_E;
             }
 

wolfcrypt/src/port/Renesas/renesas_fspsm_sha.c

@@ -418,7 +418,7 @@ static int FSPSM_HashFinal(wolfssl_FSPSM_Hash* hash, byte* out, word32 outSz)
  #endif
     wc_fspsm_hw_lock();
 
-    if (Init(&handle) == FSP_SUCCESS) {
+    if ((ret = Init(&handle)) == FSP_SUCCESS) {
         ret = Update(&handle, (uint8_t*)hash->msg, hash->used);
         if (ret == FSP_SUCCESS) {
             ret = Final(&handle, out, (uint32_t*)&sz);
@@ -433,6 +433,10 @@ static int FSPSM_HashFinal(wolfssl_FSPSM_Hash* hash, byte* out, word32 outSz)
             }
         }
     }
+
+    if (ret != FSP_SUCCESS)
+        ret = WC_HW_E;
+
     wc_fspsm_hw_unlock();
 
 #elif defined(WOLFSSL_RENESAS_RSIP)

wolfcrypt/src/port/caam/wolfcaam_ecdsa.c

@@ -339,7 +339,7 @@ int wc_CAAM_EccSign(const byte* in, int inlen, byte* out, word32* outlen,
 
     /* private key */
     if (key->blackKey == CAAM_BLACK_KEY_SM) {
-        buf[idx].TheAddress = (CAAM_ADDRESS)key->blackKey;
+        buf[idx].TheAddress = key->blackKey;
         args[0] = CAAM_BLACK_KEY_SM; /* is a black key in sm */
         buf[idx].Length = keySz;
     }

wolfcrypt/src/port/caam/wolfcaam_hmac.c

@@ -54,7 +54,7 @@ int wc_CAAM_Hmac(Hmac* hmac, int macType, const byte* msg, int msgSz,
 {
     int ret = 0;
 
-    if (hmac->ctx.cfd == -1 && hmac->keyLen > 0) {
+    if (hmac->ctx.inited == 0 && hmac->keyLen > 0) {
         ret = wc_DevCrypto_HmacSetKey(hmac, macType, hmac->keyRaw,
                     hmac->keyLen);
         if (ret != 0) {

wolfcrypt/src/port/devcrypto/devcrypto_aes.c

@@ -49,7 +49,7 @@ int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
     if (sz == 0) {
         return 0;
     }
-    if (aes->ctx.cfd == -1) {
+    if (aes->ctx.inited == 0) {
             ret = wc_DevCryptoCreate(&aes->ctx, CRYPTO_AES_CBC,
                     (byte*)aes->devKey, aes->keylen);
             if (ret != 0)
@@ -82,7 +82,7 @@ int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
     }
 
     XMEMCPY(aes->tmp, in + sz - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
-    if (aes->ctx.cfd == -1) {
+    if (aes->ctx.inited == 0) {
         ret = wc_DevCryptoCreate(&aes->ctx, CRYPTO_AES_CBC,
                     (byte*)aes->devKey, aes->keylen);
         if (ret != 0)
@@ -110,7 +110,7 @@ int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen,
     const word32 max_key_len = (AES_MAX_KEY_SIZE / 8);
 #endif
 
-    if (aes == NULL ||
+    if (aes == NULL || userKey == NULL ||
             !((keylen == 16) || (keylen == 24) || (keylen == 32))) {
         return BAD_FUNC_ARG;
     }
@@ -129,6 +129,7 @@ int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen,
     aes->left = 0;
 #endif
     aes->ctx.cfd = -1;
+    aes->ctx.inited = 0;
     XMEMCPY(aes->devKey, userKey, keylen);
 
     (void)dir;
@@ -151,7 +152,7 @@ static int wc_DevCrypto_AesDirect(Aes* aes, byte* out, const byte* in,
         return BAD_FUNC_ARG;
     }
 
-    if (aes->ctx.cfd == -1) {
+    if (aes->ctx.inited == 0) {
         ret = wc_DevCryptoCreate(&aes->ctx, CRYPTO_AES_ECB, (byte*)aes->devKey,
                 aes->keylen);
         if (ret != 0)
@@ -221,7 +222,7 @@ int wc_AesCtrEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
         sz--;
     }
 
-    if (aes->ctx.cfd == -1) {
+    if (aes->ctx.inited == 0) {
         ret = wc_DevCryptoCreate(&aes->ctx, CRYPTO_AES_CTR, (byte*)aes->devKey,
                 aes->keylen);
         if (ret != 0)
@@ -284,8 +285,6 @@ int wc_AesGcmSetKey(Aes* aes, const byte* key, word32 len)
     return wc_AesSetKey(aes, key, len, NULL, AES_ENCRYPTION);
 }
 
-
-
 /* common code for AES-GCM encrypt/decrypt */
 static int wc_DevCrypto_AesGcm(Aes* aes, byte* out, byte* in, word32 sz,
                    const byte* iv, word32 ivSz,
@@ -310,7 +309,7 @@ static int wc_DevCrypto_AesGcm(Aes* aes, byte* out, byte* in, word32 sz,
         in = scratch;
 
     XMEMSET(scratch, 0, WC_AES_BLOCK_SIZE);
-    if (aes->ctx.cfd == -1) {
+    if (aes->ctx.inited == 0) {
         ret = wc_DevCryptoCreate(&aes->ctx, CRYPTO_AES_GCM, (byte*)aes->devKey,
                 aes->keylen);
         if (ret != 0)
@@ -399,4 +398,3 @@ int wc_AesEcbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
 #endif /* HAVE_AES_ECB */
 #endif /* WOLFSSL_DEVCRYPTO_AES */
 #endif /* !NO_AES && WOLFSSL_DEVCRYPTO */
-