Fix various issues

CMakeLists.txt

@@ -101,6 +101,7 @@ check_include_file("time.h" HAVE_TIME_H)
 check_include_file("sys/ioctl.h" HAVE_SYS_IOCTL_H)
 check_include_file("sys/socket.h" HAVE_SYS_SOCKET_H)
 check_include_file("sys/time.h" HAVE_SYS_TIME_H)
+check_include_file("sys/un.h" HAVE_SYS_UN_H)
 check_include_file("errno.h" HAVE_ERRNO_H)
 check_include_file("dlfcn.h" HAVE_DLFCN_H)
 check_include_file("inttypes.h" HAVE_INTTYPES_H)
@@ -113,13 +114,21 @@ check_include_file("sys/stat.h" HAVE_SYS_STAT_H)
 check_include_file("sys/types.h" HAVE_SYS_TYPES_H)
 check_include_file("unistd.h" HAVE_UNISTD_H)
 
-# types.h depends on HAVE_LIMITS_H, and it is defined in options.h (rather than
-# config.h) so that applications consuming wolfSSL headers see it. The in-tree
-# build, however, is configured through config.h/compile definitions and does
-# not include options.h, so define it here as well.
+# types.h depends on HAVE_LIMITS_H, and callbacks.h sizes WOLFSSL_TIMEVAL with
+# HAVE_SYS_TIME_H. Both are defined in options.h (rather than config.h) so that
+# applications consuming wolfSSL headers see the same value the library was
+# built with. The in-tree build, however, is configured through
+# config.h/compile definitions and does not include options.h, so define them
+# here as well.
 if(HAVE_LIMITS_H)
     add_definitions("-DHAVE_LIMITS_H")
 endif()
+if(HAVE_SYS_TIME_H)
+    add_definitions("-DHAVE_SYS_TIME_H")
+endif()
+if(HAVE_SYS_UN_H)
+    add_definitions("-DHAVE_SYS_UN_H")
+endif()
 
 include(CheckFunctionExists)
 

cmake/config.in

@@ -34,9 +34,6 @@
 /* Define to 1 if you have the <string.h> header file. */
 #cmakedefine HAVE_STRING_H @HAVE_STRING_H@
 
-/* Define to 1 if you have the <sys/time.h> header file. */
-#cmakedefine HAVE_SYS_TIME_H @HAVE_SYS_TIME_H@
-
 /* Define to 1 if you have the <Security/SecTrustSettings.h> header file. */
 #cmakedefine HAVE_SECURITY_SECTRUSTSETTINGS_H @HAVE_SECURITY_SECTRUSTSETTINGS_H@
 

cmake/options.h.in

@@ -41,6 +41,12 @@ extern "C" {
 /* Since types.h depends on HAVE_LIMITS_H, we must define it in options.h. */
 #undef HAVE_LIMITS_H
 #cmakedefine HAVE_LIMITS_H @HAVE_LIMITS_H@
+/* callbacks.h sizes WOLFSSL_TIMEVAL with HAVE_SYS_TIME_H, so it must be in
+ * options.h too. */
+#undef HAVE_SYS_TIME_H
+#cmakedefine HAVE_SYS_TIME_H @HAVE_SYS_TIME_H@
+#undef HAVE_SYS_UN_H
+#cmakedefine HAVE_SYS_UN_H @HAVE_SYS_UN_H@
 #undef ASIO_USE_WOLFSSL
 #cmakedefine ASIO_USE_WOLFSSL
 #undef BOOST_ASIO_USE_WOLFSSL

configure.ac

@@ -221,9 +221,14 @@ then
     fi
 fi
 
-AC_CHECK_HEADERS([arpa/inet.h fcntl.h netdb.h netinet/in.h stddef.h time.h sys/ioctl.h sys/socket.h sys/time.h errno.h sys/un.h ctype.h sys/random.h])
+AC_CHECK_HEADERS([arpa/inet.h fcntl.h netdb.h netinet/in.h stddef.h time.h sys/ioctl.h sys/socket.h errno.h ctype.h sys/random.h])
 # Special case: Since types.h depends on HAVE_LIMITS_H, we must define it in options.h.
 AC_CHECK_HEADER([limits.h], [AM_CPPFLAGS="$AM_CPPFLAGS -DHAVE_LIMITS_H=1"], [])
+# Special case: these gate the layout of public types in installed headers
+# (union WOLFSSL_BIO_ADDR in wolfio.h, WOLFSSL_TIMEVAL in callbacks.h), so
+# applications must see the same value the library was built with.
+AC_CHECK_HEADER([sys/un.h], [AM_CPPFLAGS="$AM_CPPFLAGS -DHAVE_SYS_UN_H=1"], [])
+AC_CHECK_HEADER([sys/time.h], [AM_CPPFLAGS="$AM_CPPFLAGS -DHAVE_SYS_TIME_H=1"], [])
 AC_CHECK_LIB([network],[socket])
 AC_C_BIGENDIAN
 AC_C___ATOMIC

src/internal.c

@@ -14198,11 +14198,11 @@ int CheckHostName(DecodedCert* dCert, const char *domainName,
     return ret;
 }
 
-int CheckIPAddr(DecodedCert* dCert, const char* ipasc)
+int CheckIPAddr(DecodedCert* dCert, const char* ipasc, size_t ipascLen)
 {
     WOLFSSL_MSG("Checking IPAddr");
 
-    return CheckHostName(dCert, ipasc, (size_t)XSTRLEN(ipasc), 0, 1);
+    return CheckHostName(dCert, ipasc, ipascLen, 0, 1);
 }
 
 
@@ -15646,7 +15646,8 @@ int DoVerifyCallback(WOLFSSL_CERT_MANAGER* cm, WOLFSSL* ssl, int cert_err,
         /* perform IP address check on the peer certificate */
         if ((args->dCertInit != 0) && (args->dCert != NULL) && (ssl != NULL) &&
             (ssl->param != NULL) && (XSTRLEN(ssl->param->ipasc) > 0)) {
-            if (CheckIPAddr(args->dCert, ssl->param->ipasc) != 0) {
+            if (CheckIPAddr(args->dCert, ssl->param->ipasc,
+                            (size_t)XSTRLEN(ssl->param->ipasc)) != 0) {
                 if (cert_err == 0) {
                     ret = IPADDR_MISMATCH;
                     WOLFSSL_ERROR_VERBOSE(ret);
@@ -18371,7 +18372,8 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
 #ifndef OPENSSL_EXTRA
                 if (!ssl->options.verifyNone && ssl->buffers.ipasc.buffer) {
                     if (CheckIPAddr(args->dCert,
-                            (const char*)ssl->buffers.ipasc.buffer) != 0) {
+                            (const char*)ssl->buffers.ipasc.buffer,
+                            (size_t)ssl->buffers.ipasc.length) != 0) {
                         WOLFSSL_MSG("IPAddr match on alt names failed");
                         ret = IPADDR_MISMATCH;
                         WOLFSSL_ERROR_VERBOSE(ret);

src/x509.c

@@ -15795,7 +15795,7 @@ int wolfSSL_X509_check_ip_asc(WOLFSSL_X509 *x, const char *ipasc,
             ret = WOLFSSL_FAILURE;
         }
         else {
-            ret = CheckIPAddr(dCert, ipasc);
+            ret = CheckIPAddr(dCert, ipasc, (size_t)XSTRLEN(ipasc));
             if (ret != 0) {
                 ret = WOLFSSL_FAILURE;
             }

tests/api/test_ossl_x509.c

@@ -422,6 +422,20 @@ int test_wolfSSL_X509_check_host(void)
     ExpectIntEQ(wolfSSL_X509_check_host(x509, altName, XSTRLEN(altName),
         WOLFSSL_MULTI_LABEL_WILDCARDS, NULL), WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
 
+    /* chk of exactly chklen bytes with no terminator - every consumer must
+     * stay within the caller's declared length. */
+    {
+        char* bounded = (char*)XMALLOC(XSTRLEN(altName), NULL,
+                                       DYNAMIC_TYPE_TMP_BUFFER);
+        ExpectNotNull(bounded);
+        if (bounded != NULL) {
+            XMEMCPY(bounded, altName, XSTRLEN(altName));
+            ExpectIntEQ(X509_check_host(x509, bounded, XSTRLEN(altName), 0,
+                    NULL), WOLFSSL_SUCCESS);
+            XFREE(bounded, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        }
+    }
+
     X509_free(x509);
 
     ExpectIntEQ(X509_check_host(NULL, altName, XSTRLEN(altName), 0, NULL),

tests/api/test_pkcs7.c

@@ -6286,18 +6286,11 @@ int test_wc_PKCS7_VerifySignedData_TruncEContentTag(void)
  * SignedData bundle truncated at the certificates [0] IMPLICIT tag.
  * Verifies that the parser rejects the malformed input rather than
  * dereferencing past the end of the buffer.
- *
- * TODO: limited to NO_PKCS7_STREAM because the streaming parser's stage 3
- * early-exit check (pkcs7.c near line 6594) accepts any bundle
- * whose remaining footer is < 6 bytes as a successful degenerate end,
- * so the bounds check at line 6765 is unreachable in streaming mode.
- * Drop the NO_PKCS7_STREAM gate if/when the early-exit check becomes
- * more accurate.
  */
 int test_wc_PKCS7_VerifySignedData_TruncCertSetTag(void)
 {
     EXPECT_DECLS;
-#if defined(HAVE_PKCS7) && defined(NO_PKCS7_STREAM)
+#if defined(HAVE_PKCS7)
     PKCS7* pkcs7 = NULL;
 
     WOLFSSL_SMALL_STACK_STATIC byte der[] = {
@@ -6337,7 +6330,71 @@ int test_wc_PKCS7_VerifySignedData_TruncCertSetTag(void)
     ExpectIntNE(wc_PKCS7_VerifySignedData(pkcs7, der, derSz), 0);
     wc_PKCS7_Free(pkcs7);
 
-#endif /* HAVE_PKCS7 && NO_PKCS7_STREAM */
+#endif /* HAVE_PKCS7 */
+    return EXPECT_RESULT();
+}
+
+/*
+ * SignedData bundle with a non-empty digestAlgorithms SET whose signerInfos
+ * field is absent entirely - the bundle stops right after the eContent.
+ * signerInfos is a required field, so the bundle must be rejected both with
+ * the default settings and with wc_PKCS7_AllowDegenerate() turned off.
+ */
+int test_wc_PKCS7_VerifySignedData_NoSignerInfos(void)
+{
+    EXPECT_DECLS;
+#if defined(HAVE_PKCS7) && !defined(NO_SHA256)
+    PKCS7* pkcs7 = NULL;
+
+    WOLFSSL_SMALL_STACK_STATIC byte der[] = {
+        /* outer ContentInfo SEQUENCE (99 bytes content) */
+        0x30, 0x63,
+        /* contentType OID signedData */
+        0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, 0x02,
+        /* [0] EXPLICIT (86 bytes content) */
+        0xA0, 0x56,
+        /* SignedData SEQUENCE (84 bytes content) */
+        0x30, 0x54,
+        /* version INTEGER 1 */
+        0x02, 0x01, 0x01,
+        /* digestAlgorithms SET (15 bytes) { sha256 AlgorithmIdentifier } */
+        0x31, 0x0F,
+        0x30, 0x0D,
+        0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
+        0x05, 0x00,
+        /* encapContentInfo SEQUENCE (62 bytes content) */
+        0x30, 0x3E,
+        /* eContentType OID 1.2.840.113549.1.7.1 (data) */
+        0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, 0x01,
+        /* eContent [0] EXPLICIT (49 bytes content) */
+        0xA0, 0x31,
+        /* OCTET STRING (47 bytes content) */
+        0x04, 0x2F,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
+        0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41
+        /* no certificates, no signerInfos: bundle ends here */
+    };
+    word32 derSz = (word32)sizeof(der);
+
+    ExpectNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, testDevId));
+    ExpectIntEQ(wc_PKCS7_Init(pkcs7, HEAP_HINT, INVALID_DEVID), 0);
+    ExpectIntEQ(wc_PKCS7_InitWithCert(pkcs7, NULL, 0), 0);
+    ExpectIntNE(wc_PKCS7_VerifySignedData(pkcs7, der, derSz), 0);
+    wc_PKCS7_Free(pkcs7);
+    pkcs7 = NULL;
+
+    ExpectNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, testDevId));
+    ExpectIntEQ(wc_PKCS7_Init(pkcs7, HEAP_HINT, INVALID_DEVID), 0);
+    ExpectIntEQ(wc_PKCS7_InitWithCert(pkcs7, NULL, 0), 0);
+    wc_PKCS7_AllowDegenerate(pkcs7, 0);
+    ExpectIntNE(wc_PKCS7_VerifySignedData(pkcs7, der, derSz), 0);
+    wc_PKCS7_Free(pkcs7);
+
+#endif /* HAVE_PKCS7 && !NO_SHA256 */
     return EXPECT_RESULT();
 }
 

tests/api/test_pkcs7.h

@@ -78,6 +78,7 @@ int test_wc_PKCS7_VerifySignedData_PKCS7ContentSeq(void);
 int test_wc_PKCS7_VerifySignedData_IndefLenOOB(void);
 int test_wc_PKCS7_VerifySignedData_TruncEContentTag(void);
 int test_wc_PKCS7_VerifySignedData_TruncCertSetTag(void);
+int test_wc_PKCS7_VerifySignedData_NoSignerInfos(void);
 int test_wc_PKCS7_VerifySignedData_NoDigestParams(void);
 
 
@@ -133,6 +134,7 @@ int test_wc_PKCS7_VerifySignedData_NoDigestParams(void);
     TEST_DECL_GROUP("pkcs7_sd", test_wc_PKCS7_VerifySignedData_IndefLenOOB), \
     TEST_DECL_GROUP("pkcs7_sd", test_wc_PKCS7_VerifySignedData_TruncEContentTag), \
     TEST_DECL_GROUP("pkcs7_sd", test_wc_PKCS7_VerifySignedData_TruncCertSetTag), \
+    TEST_DECL_GROUP("pkcs7_sd", test_wc_PKCS7_VerifySignedData_NoSignerInfos), \
     TEST_DECL_GROUP("pkcs7_sd", test_wc_PKCS7_VerifySignedData_NoDigestParams)
 
 #define TEST_PKCS7_ENCRYPTED_DATA_DECLS                                     \

wolfcrypt/src/ecc.c

@@ -9593,6 +9593,11 @@ static int ecc_verify_hash(mp_int *r, mp_int *s, const byte* hash,
         u1 = u1tmp;
         u2 = u2tmp;
     #endif
+       /* zeroed so the cleanup below no-ops if the init is skipped */
+       if (u1 != NULL)
+           XMEMSET(u1, 0, sizeof(mp_int));
+       if (u2 != NULL)
+           XMEMSET(u2, 0, sizeof(mp_int));
 #else
        u1 = e;
        u2 = w;

wolfcrypt/src/pkcs7.c

@@ -7506,26 +7506,31 @@ static int PKCS7_VerifySignedData(wc_PKCS7* pkcs7, const byte* hashBuf,
                 pkcs7->content   = pkcs7->contentDynamic;
             }
 
-            /* check if bundle has more elements or footer, if not, set content
-             * to pkcs7->content and hash to pkcs7->hash.
+            /* expect data length to be enough to check set and seq of certs,
+             * but never more than what is left inside the outer ContentInfo,
+             * so that a short footer (such as an empty signerInfos SET "31 00"
+             * with no certificates) is still parsed by the stages below rather
+             * than stalling on a window the bundle cannot fill.
              *
-             * NOTE: this check returns success whenever fewer than 6 bytes
-             * follow the content within the outer ContentInfo, which also
-             * accepts truncated bundles whose footer was cut short (e.g. a
-             * lone certificates [0] tag with no length). Distinguishing a
-             * legitimate degenerate end (such as an empty signerInfos SET
-             * "31 00") from truncated junk would require peeking at the
-             * remaining bytes or making stage 4's `expected` window smaller.
-             */
-            if (ret == 0 && pkcs7->stream->maxLen > 0 &&
-                    (pkcs7->stream->maxLen - pkcs7->stream->totalRd)
-                                                < ASN_TAG_SZ + MAX_LENGTH_SZ) {
+             * maxLen only bounds the bundle when it was taken from a complete
+             * outer SEQUENCE header; a caller feeding small chunks can leave
+             * it behind totalRd, so leave the window uncapped in that case
+             * rather than subtracting past zero. */
+            pkcs7->stream->expected = (ASN_TAG_SZ + MAX_LENGTH_SZ) * 2;
+            if (pkcs7->stream->maxLen > 0 &&
+                    pkcs7->stream->maxLen >= pkcs7->stream->totalRd) {
+                if (pkcs7->stream->expected > (pkcs7->stream->maxLen -
+                                pkcs7->stream->totalRd) + pkcs7->stream->length)
+                    pkcs7->stream->expected = (pkcs7->stream->maxLen -
+                                pkcs7->stream->totalRd) + pkcs7->stream->length;
 
-                ret = 0;
-                break;
+                /* signerInfos is a required field of SignedData */
+                if (pkcs7->stream->expected == 0) {
+                    WOLFSSL_MSG("PKCS7 bundle ends before signerInfos");
+                    ret = PKCS7_NO_SIGNER_E;
+                    break;
+                }
             }
-            /* expect data length to be enough to check set and seq of certs */
-            pkcs7->stream->expected = (ASN_TAG_SZ + MAX_LENGTH_SZ) * 2;
 
         #else
             /* Break out before content because it can be optional in degenerate

wolfcrypt/src/rsa.c

@@ -5077,6 +5077,12 @@ static int wc_CompareDiffPQ(mp_int* p, mp_int* q, int size, int* valid)
     else
         ret = 0;
 
+    /* zeroed so the cleanup below no-ops if the init is skipped */
+    if (c != NULL)
+        XMEMSET(c, 0, sizeof(*c));
+    if (d != NULL)
+        XMEMSET(d, 0, sizeof(*d));
+
     if (ret == 0)
 #endif
         ret = mp_init_multi(c, d, NULL, NULL, NULL, NULL);
@@ -5343,6 +5349,15 @@ int wc_CheckProbablePrime_ex(const byte* pRaw, word32 pRawSz,
     }
     else
         ret = 0;
+
+    /* zeroed so the cleanup below no-ops if the init is skipped */
+    if (p != NULL)
+        XMEMSET(p, 0, sizeof(*p));
+    if (q != NULL)
+        XMEMSET(q, 0, sizeof(*q));
+    if (e != NULL)
+        XMEMSET(e, 0, sizeof(*e));
+
     if (ret == 0)
 #endif
         ret = mp_init_multi(p, q, e, NULL, NULL, NULL);

wolfcrypt/src/srp.c

@@ -617,6 +617,11 @@ int wc_SrpGetPublic(Srp* srp, byte* pub, word32* size)
             if (((i = (mp_int *)XMALLOC(sizeof(*i), srp->heap, DYNAMIC_TYPE_TMP_BUFFER)) == NULL) ||
                 ((j = (mp_int *)XMALLOC(sizeof(*j), srp->heap, DYNAMIC_TYPE_TMP_BUFFER)) == NULL))
                 r = MEMORY_E;
+            /* zeroed so the cleanup below no-ops if the init is skipped */
+            if (i != NULL)
+                XMEMSET(i, 0, sizeof(*i));
+            if (j != NULL)
+                XMEMSET(j, 0, sizeof(*j));
             if (!r)
 #endif
             {
@@ -762,6 +767,16 @@ int wc_SrpComputeKey(Srp* srp, byte* clientPubKey, word32 clientPubKeySz,
     temp1 = (mp_int *)XMALLOC(sizeof *temp1, srp->heap, DYNAMIC_TYPE_SRP);
     temp2 = (mp_int *)XMALLOC(sizeof *temp2, srp->heap, DYNAMIC_TYPE_SRP);
 
+    /* zeroed so the cleanup below no-ops if the init is skipped */
+    if (u != NULL)
+        XMEMSET(u, 0, sizeof *u);
+    if (s != NULL)
+        XMEMSET(s, 0, sizeof *s);
+    if (temp1 != NULL)
+        XMEMSET(temp1, 0, sizeof *temp1);
+    if (temp2 != NULL)
+        XMEMSET(temp2, 0, sizeof *temp2);
+
     if ((hash == NULL) ||
         (digest == NULL) ||
         (u == NULL) ||

wolfssl/internal.h

@@ -2246,7 +2246,8 @@ WOLFSSL_TEST_VIS int  MatchDomainName(const char* pattern, int len,
 WOLFSSL_LOCAL int  CheckForAltNames(DecodedCert* dCert, const char* domain,
                                     word32 domainLen, int* checkCN,
                                     unsigned int flags, byte isIP);
-WOLFSSL_LOCAL int  CheckIPAddr(DecodedCert* dCert, const char* ipasc);
+WOLFSSL_LOCAL int  CheckIPAddr(DecodedCert* dCert, const char* ipasc,
+                               size_t ipascLen);
 WOLFSSL_LOCAL void CopyDecodedName(WOLFSSL_X509_NAME* name, DecodedCert* dCert, int nameType);
 #endif
 WOLFSSL_LOCAL int  SetupTicket(WOLFSSL* ssl);

wolfssl/wolfcrypt/settings.h

@@ -380,6 +380,17 @@
     #endif
 #endif
 
+/* A configure-generated options.h is sometimes copied in as user_settings.h to
+ * seed a Windows build, bringing the POSIX host's header probes with it. Drop
+ * them where the target has no such header; MinGW has <sys/time.h> but not
+ * <sys/un.h>. */
+#ifdef _MSC_VER
+    #undef HAVE_SYS_TIME_H
+#endif
+#ifdef _WIN32
+    #undef HAVE_SYS_UN_H
+#endif
+
 /* Microsoft's ARM64 compiler defines _M_ARM64 but not __aarch64__.  The wolfSSL
  * ARMv8 assembly (WOLFSSL_ARMASM) and all of its C callers are gated on
  * __aarch64__, so map _M_ARM64 across when building that assembly with MSVC and