wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-07-07 10:40:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #9915 from julek-wolfssl/fenrir/378

Browse Source 
wc_PKCS7_PwriKek_KeyUnWrap: use a ct cmp
This commit is contained in:
Daniel Pouzzner
2026-03-06 22:32:18 -06:00
committed by GitHub
parent f0ba67ee21 14357576d8
commit e74d52a32e
1 changed files with 9 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wolfcrypt/src/pkcs7.c
+9 -15
View File
@@ -9520,6 +9520,7 @@ static int wc_PKCS7_PwriKek_KeyUnWrap(wc_PKCS7* pkcs7, const byte* kek,
byte* tmpIv = NULL;
byte* lastBlock = NULL;
byte* outTmp = NULL;
byte fail = 0;
if (pkcs7 == NULL || kek == NULL || in == NULL ||
out == NULL || iv == NULL) {
@@ -9581,27 +9582,20 @@ static int wc_PKCS7_PwriKek_KeyUnWrap(wc_PKCS7* pkcs7, const byte* kek,
cekLen = outTmp[0];
/* verify length */
if ((word32)cekLen > inSz) {
ForceZero(outTmp, inSz);
XFREE(outTmp, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
return BAD_FUNC_ARG;
}
fail |= ctMaskGT(cekLen, (int)inSz);
/* verify check bytes */
if ((outTmp[1] ^ outTmp[4]) != 0xFF ||
(outTmp[2] ^ outTmp[5]) != 0xFF ||
(outTmp[3] ^ outTmp[6]) != 0xFF) {
fail |= ctMaskNotEq((int)(outTmp[1] ^ outTmp[4]), 0xFF);
fail |= ctMaskNotEq((int)(outTmp[2] ^ outTmp[5]), 0xFF);
fail |= ctMaskNotEq((int)(outTmp[3] ^ outTmp[6]), 0xFF);
/* verify length */
fail |= ctMaskGT(cekLen, (int)outSz);
if (fail) {
ForceZero(outTmp, inSz);
XFREE(outTmp, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
return BAD_FUNC_ARG;
}
if (outSz < (word32)cekLen) {
ForceZero(outTmp, inSz);
XFREE(outTmp, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
return BUFFER_E;
}
XMEMCPY(out, outTmp + 4, outTmp[0]);
ForceZero(outTmp, inSz);
XFREE(outTmp, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);