wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-31 19:24:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

add strict check on signature length

Browse Source
This commit is contained in:
Jacob Barthelmeh
2021-06-05 03:09:33 +07:00
parent d7117cd8bb
commit c245c4a812
2 changed files with 29 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
tests/api.c
View File

@@ -21038,6 +21038,7 @@ static int test_wc_ecc_signVerify_hash (void)
#endif
word32 siglen = ECC_BUFSIZE;
byte sig[ECC_BUFSIZE];
byte adjustedSig[ECC_BUFSIZE+1];
byte digest[] = TEST_STRING;
word32 digestlen = (word32)TEST_STRING_SZ;
@@ -21095,6 +21096,20 @@ static int test_wc_ecc_signVerify_hash (void)
if (verify != 1 && ret == 0) {
ret = WOLFSSL_FATAL_ERROR;
}
/* test check on length of signature passed in */
XMEMCPY(adjustedSig, sig, siglen);
adjustedSig[1] = adjustedSig[1] + 1; /* add 1 to length for extra byte*/
#ifndef NO_STRICT_ECDSA_LEN
AssertIntNE(wc_ecc_verify_hash(adjustedSig, siglen+1, digest, digestlen,
&verify, &key), 0);
#else
/* if NO_STRICT_ECDSA_LEN is set then extra bytes after the signature
* is allowed */
AssertIntEQ(wc_ecc_verify_hash(adjustedSig, siglen+1, digest, digestlen,
&verify, &key), 0);
#endif
/* Test bad args. */
if (ret == 0) {
verifyH = wc_ecc_verify_hash(NULL, siglen, digest, digestlen,

14
wolfcrypt/src/asn.c
View File

@@ -15964,6 +15964,12 @@ int DecodeECC_DSA_Sig_Bin(const byte* sig, word32 sigLen, byte* r, word32* rLen,
if (s)
XMEMCPY(s, (byte*)sig + idx, len);
#ifndef NO_STRICT_ECDSA_LEN
if (idx + len != sigLen) {
ret = ASN_ECC_KEY_E;
}
#endif
return ret;
}
#endif
@@ -15999,6 +16005,14 @@ int DecodeECC_DSA_Sig(const byte* sig, word32 sigLen, mp_int* r, mp_int* s)
return ASN_ECC_KEY_E;
}
#ifndef NO_STRICT_ECDSA_LEN
if (idx != sigLen) {
mp_clear(r);
mp_clear(s);
return ASN_ECC_KEY_E;
}
#endif
return 0;
}
#endif