wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-08-14 23:51:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Reset MlDsaKey between decode attempts in X509_set_pubkey

Browse Source
This commit is contained in:
Takashi Kojo
2026-08-07 07:38:29 +09:00
parent 1fda7341d3
commit 69749e8f99
2 changed files with 34 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/x509.c
+10
View File
@@ -16600,6 +16600,16 @@ int wolfSSL_X509_set_pubkey(WOLFSSL_X509 *cert, WOLFSSL_EVP_PKEY *pkey)
PRIVATE_KEY_LOCK();
#endif
if (!decodeOk) {
#ifdef WOLFSSL_MLDSA_PRIVATE_KEY
/* A failed PrivateKeyDecode may leave the level pinned;
* reset the key so PublicKeyDecode auto-detects it from
* the SPKI OID. */
wc_MlDsaKey_Free(mldsa);
if (wc_MlDsaKey_Init(mldsa, NULL, INVALID_DEVID) != 0) {
XFREE(mldsa, cert->heap, DYNAMIC_TYPE_MLDSA);
return WOLFSSL_FAILURE;
}
#endif
idx = 0;
if (wc_MlDsaKey_PublicKeyDecode(mldsa,
(const byte*)pkey->pkey.ptr, (word32)pkey->pkey_sz,
tests/api/test_ossl_x509_pk.c
+24
View File
@@ -405,6 +405,30 @@ int test_wolfSSL_X509_set_pubkey(void)
pubkey = NULL;
}
#endif
/* Public-only EVP_PKEY holding an SPKI: the private-key decode
* fails and the fallback public decode must work on a reset key. */
{
WOLFSSL_EVP_PKEY* spki = NULL;
unsigned char der[2048];
int derSz = 0;
const unsigned char* pp = der;
XFILE f = XBADFILE;
ExpectTrue((f = XFOPEN("./certs/mldsa/mldsa44_pub-spki.der",
"rb")) != XBADFILE);
ExpectIntGT(derSz = (int)XFREAD(der, 1, sizeof(der), f), 0);
if (f != XBADFILE)
XFCLOSE(f);
ExpectNotNull(spki = wolfSSL_d2i_PUBKEY(NULL, &pp, (long)derSz));
ExpectIntEQ(wolfSSL_X509_set_pubkey(x509, spki), WOLFSSL_SUCCESS);
ExpectNotNull(pubkey = wolfSSL_X509_get_pubkey(x509));
ExpectIntEQ(wolfSSL_EVP_PKEY_id(pubkey), WC_EVP_PKEY_DILITHIUM);
wolfSSL_EVP_PKEY_free(pubkey);
pubkey = NULL;
wolfSSL_EVP_PKEY_free(spki);
}
wolfSSL_EVP_PKEY_free(pkey);
pkey = NULL;
}