From 9533a8182a349180d9155a9acafee83245cfe516 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Wed, 5 Aug 2026 16:42:37 +0200 Subject: [PATCH] Fix RSA_W_ENC verify guard in signature wrapper The DigestInfo length extraction in wc_SignatureVerifyHash was compiled only when WOLFSSL_RSA_PUBLIC_ONLY was not defined, but the block depends on ASN.1 support, not on private key support. In a public only build the RSA verify path stays reachable and wc_SignatureVerify still DER encodes the digest, so the length check fell through to the plain digest size comparison and rejected every valid signature with BAD_LENGTH_E. The same guard also broke compilation with NO_ASN and RSA enabled, since asn.h is not included in that case and GetSequence and GetOctetString are undeclared. Guard the block on NO_ASN instead, matching the DER encode call site in wc_SignatureVerify. Fixes F-7412. --- .github/configs/os-check-linux.json | 6 +++++- wolfcrypt/src/signature.c | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/configs/os-check-linux.json b/.github/configs/os-check-linux.json index 9f88d442ed..74839527ba 100644 --- a/.github/configs/os-check-linux.json +++ b/.github/configs/os-check-linux.json @@ -336,5 +336,9 @@ {"name": "opensslextra-no-filesystem-no-bio", "minutes": 0.9, "configure": ["--enable-opensslextra", "--disable-filesystem", "CPPFLAGS=-DNO_BIO"]}, {"name": "no-examples-no-malloc", "minutes": 0.8, - "configure": ["--disable-examples", "CPPFLAGS=-DWOLFSSL_NO_MALLOC"]} + "configure": ["--disable-examples", "CPPFLAGS=-DWOLFSSL_NO_MALLOC"]}, +{"name": "cryptonly-no-asn-rsa", "minutes": 0.2, "check": false, + "comment": "RSA with ASN.1 disabled. Build only, since wolfcrypt test and benchmark do not support this combination.", + "configure": ["--enable-cryptonly", "--disable-asn", "--enable-lowresource", + "--disable-crypttests", "--disable-examples"]} ] diff --git a/wolfcrypt/src/signature.c b/wolfcrypt/src/signature.c index 797cfeffb9..8e1c10f052 100644 --- a/wolfcrypt/src/signature.c +++ b/wolfcrypt/src/signature.c @@ -203,7 +203,7 @@ int wc_SignatureVerifyHash( return ret; } -#if !defined(NO_RSA) && !defined(WOLFSSL_RSA_PUBLIC_ONLY) +#if !defined(NO_RSA) && !defined(NO_ASN) /* For WC_SIGNATURE_TYPE_RSA_W_ENC, we need to extract the actual size of * the ASN.1-encoded hash. */