The 2026.1 release renamed and reshaped parts of the xilasu client API, so a
new asu_compat.h maps the changed names to WC_ASU_ names and the engine files
read the same against either release. Set WOLFSSL_VERSAL_GEN2_ASU_XILASU_2026_1
for a 2026.1 BSP; the port assumes 2025.2 otherwise and stops the build with a
clear message when the macro and the BSP do not match. 2026.1 also offloads
work the older release could not, so this turns on P-521, X25519, X448, RSA
OAEP decrypt, SHAKE output past 64 bytes, and CCM on data that is not a whole
number of blocks, each with a macro to opt back out.
ProcessChainOCSPRequest() stores each request at the certificate's position
in the chain, counting from 1 for the first intermediate, while csr->requests
is a count of successful calls. TLSX_CSR_Free() bounded the free by that
count, so any entry written at an index at or above it was never released:
valgrind reports the serial and URL buffers InitOcspRequest() allocated as
definitely lost.
Walk the whole array instead. FreeOcspRequest() is a no-op on a request that
was never populated, and the array is sized MAX_CERT_EXTENSIONS.
wolfSSL/simulators#17 (P-256 + 28-byte-digest verify case in
wolfcrypt-test) merged to main as c827ac7. Pin the workflow to that
merge commit so the STSAFE job exercises the regression test against
the digest normalization fixed on this branch.
The A100/A110 stsafe_verify wrote *pResult before validating any of
its arguments, unlike the A120 variant which rejects NULL inputs.
Move the argument validation (pointers plus hashSz) ahead of the
*pResult write and the buffer allocation, so a NULL argument returns
BAD_FUNC_ARG instead of dereferencing, and the early return happens
before the SMALL_STACK buffers are allocated.
Addresses the PR review note on *pResult before validation.
hashSz is a caller-supplied word32 (the public wc_ecc_verify_hash API
passes its length straight through to the crypto-cb). Converting it to
int before clamping lets values above INT_MAX wrap negative, and the
normalized-copy pointer arithmetic then writes out of bounds of the
field-size digest buffer. Clamp in the word32 domain first; the int
conversion then only happens for values bounded by key_sz.
Both variants (A120, A100/A110) carry the same fix. Both call sites
already reject key_sz <= 0, so no key_sz check is added here.
Addresses the PR review note on the copy_sz cast.
The pinned wolfSSL/simulators ref gains the P-256 + 28-byte-digest
verify case in wolfcrypt-test, which exercises the digest
normalization fixed in the previous commit. The simulators branch
carrying 9f9900295 (PR wolfSSL/simulators#17) must be pushed/merged before this ref is reachable.
stsafe_verify copied key_sz bytes from the caller's digest buffer and
told the SE the digest was key_sz bytes long. For a digest shorter than
the field size (P-256 with a 28-byte SHA-224 hash, P-384 with SHA-256)
that reads past the end of the buffer and submits a wrong digest, so a
valid signature fails to verify.
The A120 expects a field-size prehash on the wire, so the digest is
normalized host-side before submission: truncate if longer, left-pad if
shorter - the same convention the sign path already applies. The SE
still receives key_sz bytes, so the wire contract is unchanged; only
the buffer contents for short digests are corrected.
Both variants (A120 STSELib, A100/A110 legacy SDK) and both call sites
(crypto-cb, TLS verify-peer callback) now use the real digest length.
Verification:
- Built: host x86_64, --enable-stsafe=a120, STSELib v1.1.7 + Rust
A120 simulator.
- Tested: wolfCrypt STSAFE-A120 sim test (wolfSSL/simulators
wolfcrypt-test): new P-256 + 28-byte-digest verify case fails on the
pre-fix build (valid signature rejected) and passes post-fix; rng,
on-device keygen, sign and 32-byte verify round-trip unchanged.
- A100/A110 variant not runnable here (closed SDK, no silicon); change
mirrors the A120 logic on the existing buffer and keeps Length=key_sz.
philljj
Sean Parkinson
Reda Chouk
JacobBarthelmeh
David Garske
Kareem
night1rider
Hideki Miyazaki
Daniele Lacamera
Eric Blankenhorn
Marco Oliverio