From 28dc1cbb677c66b3b1b3ec6ae76f4ead99362b75 Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Mon, 3 Dec 2018 12:00:04 -0700 Subject: [PATCH 1/2] fix unit test for PKCS#7 with AES disabled --- tests/api.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/tests/api.c b/tests/api.c index f82c9ef2e..1b3a835ac 100644 --- a/tests/api.c +++ b/tests/api.c @@ -15781,21 +15781,26 @@ static void test_wc_PKCS7_EncodeDecodeEnvelopedData (void) AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(pkcs7, output, 0, decoded, (word32)sizeof(decoded)), BAD_FUNC_ARG); /* Should get a return of BAD_FUNC_ARG with structure data. Order matters.*/ +#if defined(HAVE_ECC) && !defined(NO_AES) + /* only a failure for KARI test cases */ tempWrd32 = pkcs7->singleCertSz; pkcs7->singleCertSz = 0; AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(pkcs7, output, (word32)sizeof(output), decoded, (word32)sizeof(decoded)), BAD_FUNC_ARG); pkcs7->singleCertSz = tempWrd32; - tempWrd32 = pkcs7->privateKeySz; - pkcs7->privateKeySz = 0; - AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(pkcs7, output, - (word32)sizeof(output), decoded, (word32)sizeof(decoded)), BAD_FUNC_ARG); - pkcs7->privateKeySz = tempWrd32; + tmpBytePtr = pkcs7->singleCert; pkcs7->singleCert = NULL; AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(pkcs7, output, (word32)sizeof(output), decoded, (word32)sizeof(decoded)), BAD_FUNC_ARG); pkcs7->singleCert = tmpBytePtr; +#endif + tempWrd32 = pkcs7->privateKeySz; + pkcs7->privateKeySz = 0; + AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(pkcs7, output, + (word32)sizeof(output), decoded, (word32)sizeof(decoded)), BAD_FUNC_ARG); + pkcs7->privateKeySz = tempWrd32; + tmpBytePtr = pkcs7->privateKey; pkcs7->privateKey = NULL; AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(pkcs7, output, From 9bda19fd252d3184ec3c0fa641770d1df1e38af9 Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Mon, 3 Dec 2018 11:15:33 -0800 Subject: [PATCH 2/2] fix for PKCS7 KEKRI array bounds check warning on gcc 8.2.0 --- wolfcrypt/src/pkcs7.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c index c036b5e7f..b03c641e5 100644 --- a/wolfcrypt/src/pkcs7.c +++ b/wolfcrypt/src/pkcs7.c @@ -6683,6 +6683,10 @@ int wc_PKCS7_AddRecipient_KEKRI(PKCS7* pkcs7, int keyWrapOID, byte* kek, return encryptedKeySz; } + if (encryptedKeySz > MAX_ENCRYPTED_KEY_SZ) { + return WC_KEY_SIZE_E; + } + encKeyOctetStrSz = SetOctetString(encryptedKeySz, encKeyOctetStr); totalSz += (encKeyOctetStrSz + encryptedKeySz);