df504300db
Merge pull request #9863 from JacobBarthelmeh/f361
...
Fix for setting curve using all caps with wolfSSL_set1_curves_list
2026-03-10 19:29:46 -05:00
65092ab5eb
Merge pull request #9838 from SparkiDev/slhdsa_1
...
FIPS 205, SLH-DSA: implementation
2026-03-10 19:28:59 -05:00
2ad5afaf4d
wolfcrypt/src/wc_slhdsa.c: fixes for uninited data reads in slhdsakey_wots_sign_chain_x4_*() and slhdsakey_wots_pk_from_sig_x4;
...
CMakeLists.txt, cmake/functions.cmake, cmake/options.h.in: fixes for -DWOLFSSL_SLHDSA.
2026-03-10 17:51:18 -05:00
4bd0658ce5
Automatically turn on LMS / XMSS full hash
...
When WOLFSSL_NO_HASH_RAW is definied due to hardware hash offload, turn
on LMS anx XMSS full hash. Without this they will not compile
automatically when there is hardware SHA acceleration.
2026-03-10 23:00:45 +01:00
0683dab9ac
TLS: Better handling of parsing TLS extensions
...
TLSX_CSR2_Parse: check didn't include length bytes
TLSX_UseSRTP_Parse: validate profile_len
TLSX_CA_Names_Parse: fix for integer overflow
TLSX_SignatureAlgorithms_Parse: set new length before checking
TLSX_ECH_Parse: better parsing
2026-03-11 07:41:13 +10:00
d37b51c3ce
Avoid one-byte read outside of allocated encrypted content buffer in wc_PKCS7_DecodeEnvelopedData()
2026-03-10 17:26:28 -04:00
528b22140b
revert PR 9909
2026-03-10 14:47:21 -06:00
77b6f531fb
evp: check ivLen in wolfSSL_EVP_CIPHER_CTX_set_iv_length.
2026-03-10 15:27:37 -05:00
5bcb9d4966
Generate CRLs from unit test script
2026-03-10 13:25:12 -07:00
0442918391
Add Zephyr 4.1+ build compatibility for wolfssl_tls_sock sample. Replace removed Kconfig options (PTHREAD_IPC, POSIX_CLOCK, NET_SOCKETS_POSIX_NAMES) with version-conditional config fragments and fix min/max macro collision with Zephyr's sys/util.h.
2026-03-10 14:23:47 -06:00
4d1b603587
Implement peer review feedback.
2026-03-10 14:15:42 -06:00
b2520f120f
Ensure user-space wolfentropy builds of the v6 module compile the correct resource
2026-03-10 10:48:43 -06:00
cbf5264d1c
replace comment character with allowed character
2026-03-10 10:23:10 -06:00
b180a279b0
ML-KEM: Fixes for comments plus bug fixes
...
wc_MlKemKey_SharedSecretSize: Check len is not NULL before use.
wc_MlKemKey_DecodePrivateKey:
Don't set flags when public key hash fails.
ForceZero the private key on failure if copied.
2026-03-10 21:09:08 +10:00
afed9d4b79
fixup! ProcessServerHello: verify extension lengths
2026-03-10 09:52:06 +01:00
ae3fcb5601
Update setup-msbuild action
...
F-534
2026-03-10 09:52:06 +01:00
62fca11726
Dockerfile: use https instead of http
...
F-532
2026-03-10 09:52:06 +01:00
3a8e4a34ce
ProcessSessionTicket: verify nonce length
2026-03-10 09:52:06 +01:00
2febc1c7f2
ProcessServerHello: verify extension lengths
...
F-428
2026-03-10 09:52:06 +01:00
186aaadf87
Pin actions/checkout version
...
F-529
2026-03-10 09:52:06 +01:00
9c4e77d47d
DoTls13ClientHello: session length is a sender side requirement
...
F-433
2026-03-10 09:52:06 +01:00
8a57ca84c3
CheckCertCRL_ex: check cbRet after callback
...
F-432
2026-03-10 09:52:05 +01:00
8696d0d2d8
QuicTransportParam_new: update len check
...
F-431
2026-03-10 09:52:05 +01:00
15dbd61dbe
Remove dead code
...
`ticket->lifetime` is never set to 0xfffffff anywhere
F-430
2026-03-10 09:52:05 +01:00
7a264162b8
wc_ChaCha20Poly1305_Decrypt: clear unauthed plaintext
...
F-452
2026-03-10 09:52:05 +01:00
0b03d56127
wc_GetKeyOID: Clean up logging in mldsa case
...
F-449
2026-03-10 09:52:05 +01:00
b02ddde4f2
Merge pull request #9886 from philljj/fix_f_193
...
wc_encrypt: add missing ForceZero for Des, Arc4, Rc2.
2026-03-09 23:43:26 -05:00
18d1190e82
Merge pull request #9924 from Frauschi/f-426
...
Fix potential underflow in sniffer
2026-03-09 23:42:32 -05:00
f5902bd29a
Merge pull request #9862 from embhorn/zd21243
...
Fix DeriveTls13Keys with no_key
2026-03-09 23:41:52 -05:00
2cb1781b9a
Merge pull request #9922 from Frauschi/f-450
...
Fix memory leak in error case within RsaMGF1
2026-03-09 23:39:30 -05:00
cd2386c87e
Merge pull request #9894 from philljj/fix_f_280
...
hpke: add missing ForceZero for eae_prk, key_schedule_context, secret.
2026-03-09 23:38:37 -05:00
3386e40453
Merge pull request #9890 from philljj/fix_f_hmac
...
hmac: add missing ForceZero for tmp, prk.
2026-03-09 23:38:04 -05:00
3736352b24
Merge pull request #9888 from philljj/fix_f_383
...
pwdbased: add missing ForceZero for blocks, v, y.
2026-03-09 23:37:24 -05:00
8f485a5b7d
Merge pull request #9929 from douzzer/20260309-nullPointerOutOfMemory
...
20260309-nullPointerOutOfMemory
(reviewed+approved by @philljj)
2026-03-09 23:36:44 -05:00
23f62bceb5
linuxkm/module_exports.c.template: add wolfssl/wolfcrypt/wc_slhdsa.h.
...
wolfcrypt/src/wc_slhdsa.c:
* refactor SAVE_VECTOR_REGISTERS2() in slhdsakey_fors_sign() as
CAN_SAVE_VECTOR_REGISTERS(), with local save-restore wrappers around the
rest of the vector calls deeper in the call stack, to avoid failing
GFP_ATOMIC allocations and long spans with interrupts disabled.
* fix numerous bugprone-macro-parentheses and bugprone-signed-char-misuses.
* use readUnalignedWord64() in SHAKE256_SET_SEED_HA_X4_*() and
slhdsakey_shake256_set_seed_ha_x4() to avoid benign unaligned access warnings
from sanitizers.
wolfcrypt/test/test.c:
* in TestDumpData(), use WOLFSSL_DEBUG_PRINTF(), not fprintf(stderr, ...), for
portability.
* in slhdsa_test_param() and slhdsa_test(), use WC_DECLARE_VAR() and friends
for SlhDsaKey allocations, and use ERROR_OUT() and single-return-point
refactors to fix error path memory leaks.
2026-03-09 23:08:42 -05:00
66caf5ad55
free enc and dec before returning MEMORY_E
2026-03-09 13:03:54 -06:00
832af2164b
Fix copy-paste error in EncodeCertReq guard check where falconKey was checked twice instead of including dilithiumKey and sphincsKey
2026-03-09 11:43:41 -07:00
ba39aacf20
use ERROR_OUT when ret != 0 instead of returning
2026-03-09 11:48:39 -06:00
133f53f03d
replace sizeof with MAX_ECIES_TEST_SZ
2026-03-09 11:39:21 -06:00
6ae38f1b91
move unused variable suppression to top of exit_rsa label
2026-03-09 11:38:12 -06:00
6e56635a09
Fix for setting curve using all caps with wolfSSL_set1_curves_list
2026-03-09 10:41:01 -06:00
5bb8b3f803
src/pk_ec.c: in wolfSSL_ECDSA_SIG_new(), mitigate false-positive nullPointerOutOfMemory by returning immediately if initial XMALLOC() fails.
2026-03-09 10:59:50 -05:00
aa4b84f9a2
wolfcrypt/src/evp_pk.c: fix benign nullPointer in d2i_make_pkey() reported by cppcheck-2.20.0.
2026-03-09 10:58:36 -05:00
84650b576c
Add WOLFSSL_API_PREFIX_MAP
2026-03-09 09:49:39 -06:00
9f1296062b
Update comment
2026-03-09 09:49:39 -06:00
4b09fb36d9
Add test test_tls13_derive_keys_no_key
2026-03-09 09:49:37 -06:00
d57474a3b7
Fix DeriveTls13Keys with no_key
2026-03-09 09:46:17 -06:00
f7127ca729
ascon: don't skip wc_AsconAEAD128_Clear on auth error.
2026-03-09 09:33:34 -05:00
1825952783
Fix undefined variable tls1 in InitSuites for PSK cipher suite
...
The WOLFSSL_OLDTLS_SHA2_CIPHERSUITES else-branch for
BUILD_TLS_PSK_WITH_AES_128_CBC_SHA256 referenced undeclared variable
`tls1` instead of `tls`, a copy-paste typo from commit a975ba9e97sameeh@wolfssl.com >
2026-03-09 14:51:59 +02:00
7ed66dd1c3
Fix potential underflow in sniffer
2026-03-09 13:37:02 +01:00
Daniel Pouzzner
Andrew Hutchings
Sean Parkinson
Josh Holtrop
JacobBarthelmeh
jordan
Paul Adelsbach
night1rider
Kaleb Himes
Juliusz Sosinowicz
Ruby Martin
aidan garske
Eric Blankenhorn
Sameeh Jubran
Tobias Frauenschläger