b562d5c7d8
Add dynamic key allocation support for Dilithium
...
This update introduces the WOLFSSL_DILITHIUM_DYNAMIC_KEYS option, allowing
for dynamic memory allocation of public and private key buffers. This change
reduces memory usage by allocating buffers only when needed.
2026-04-14 13:22:12 +02:00
ef4e11b016
add missing WOLFSSL_QUIC_MAX_RECORD_CAPACITY check on the early-data path in quic_record_make() and added a unit test for it
2026-04-14 12:43:19 +02:00
e10ff384ba
Fix unrelated flaky test
2026-04-14 10:36:47 +02:00
467ed28d3f
wolfcrypt/mlkem: fix -Wparentheses-equality error when WOLF_CRYPTO_CB_FIND is defined
2026-04-13 22:30:22 -06:00
86c56de33f
Address peer review comments
2026-04-13 21:32:54 -06:00
58a27848a8
Fix NULL derefs, buffer overflow, and i2d contract in EVP/OCSP/X509
...
Harden OpenSSL compatibility layer against NULL pointers, negative lengths,
and buffer overflows across EVP, OCSP, and X509 APIs. Fix DSA SignFinal
write-before-check overflow, add missing i2d_OCSP_RESPONSE allocation path,
and fix unaligned keyUsage access.
2026-04-13 20:29:50 -07:00
59a17dd598
Unit testing: Add Monte Carlo testing to ciphers
...
Monte Carlo testing is randomized test data.
These new tests have random keys, IVs, nonce, etc and random data to
encrypt.
100 sets of random test data are encrypted and decrypted with a check to
ensure the input to encrypt is the same as the output of decrypt.
Tags are generated and checked in the calls to encrypt and decrypt.
2026-04-14 13:25:15 +10:00
ae1da8af43
Add missing NULL checks in public API functions
...
Add NULL and bounds validation to public API entry points that
were missing basic argument checks. Fixes span ALPN, session cache,
X509, SRP, PrivateKey ID/Label, and OBJ_obj2txt.
2026-04-13 19:05:41 -07:00
2965edb1a9
Correct buffer size for XINET_PTON in FUSION_RTOS
2026-04-14 08:36:53 +08:00
42af7f86ed
Add MQX RTCS compatibility for XINET_PTON
2026-04-14 08:36:53 +08:00
c4c2d8fafe
src/include.am, wolfcrypt/src/aes.c, wolfcrypt/src/port/riscv/riscv-64-aes.c: initial buildability of fips-dev with --enable-riscv-asm.
2026-04-13 18:57:20 -05:00
fffb80d221
Clear sha3->hashType in InitSha3 so Final fully resets the struct for cross sha3 reuse.
2026-04-13 17:12:49 -06:00
4c8c67f8aa
Add --enable-cryptocb --enable-keygen -DWOLF_CRYPTO_CB_FIND CI config to surface mlkem SHA3 hashType latch bug
2026-04-13 16:57:59 -06:00
d692f99631
More peer review fixes (Use ML-DSA naming)
2026-04-13 15:55:31 -07:00
5f124a9ae9
Peer review fixes
2026-04-13 15:30:58 -07:00
72c57dc127
Improvements to C# PQC
2026-04-13 15:30:57 -07:00
21be3776bd
add ML-KEM/ML-DSA support for C# wrapper
2026-04-13 15:29:57 -07:00
9176185d66
Merge pull request #10171 from dgarske/hpke_csharp
...
Add HPKE (RFC 9180) C# wrapper
2026-04-14 08:27:03 +10:00
649a32fd6e
Merge pull request #10169 from embhorn/zd21565
...
Fix for peer cert verify with IP address
2026-04-14 08:21:23 +10:00
33310010a9
Fix wolfSSL_sk_X509_OBJECT_deep_copy to check bounds
2026-04-13 17:02:51 -05:00
373b45cd7a
Fix dangling secure_renegotiation pointer after TLSX_FreeAll
...
ssl->secure_renegotiation caches a pointer into extension data owned by
the ssl->extensions list. Three call sites free that list via TLSX_FreeAll
without NULLing the cached pointer, leaving it dangling:
- wolfSSL_clear()
- FreeHandshakeResources() (TLSX_FreeAll branch)
- wolfSSL_ResourceFree()
After wolfSSL_clear(), calling wolfSSL_SSL_get_secure_renegotiation_support()
reads the freed SecureRenegotiation struct. Confirmed heap-use-after-free
under ASan with nginx, haproxy, and openssl-compat build profiles.
NULL the pointer at all three sites. Add regression test covering the
wolfSSL_clear path.
2026-04-13 14:53:22 -07:00
525714ca7c
Fixup C++ Problem
2026-04-13 17:29:23 -04:00
863db50318
Fix word32 truncation and add true regression test for PKCS12 OOB read
2026-04-13 16:05:51 -05:00
dc9d16c10c
remove bad character
2026-04-13 14:47:16 -06:00
99d1c80bde
Add regression test
2026-04-13 22:25:15 +02:00
f540bb3ddf
SetSuitesHashSigAlgo fix
...
ZD#21599
2026-04-13 22:25:15 +02:00
4cb016f434
Fix pkcs12 parse issue
2026-04-13 15:11:15 -05:00
ff7a32d022
Fix TLSX_EchChangeSNI to check hostname length
2026-04-13 14:53:06 -05:00
b17755b63f
Merge pull request #10164 from rizlik/bio
...
BIO improvements and fixes
2026-04-13 12:40:02 -07:00
a143369522
Merge pull request #10138 from padelsbach/cobalt-fixes-2026-04-06
...
Use size_t in wolfSSL_strnstr and reject negative indices in mp_get_digit
2026-04-13 12:37:59 -07:00
8cc02d8a8a
Add DH regression test and incremement ref counter tests to api.c
2026-04-13 11:32:51 -06:00
0ab5401edf
Fix cast-away-const in ws_ctx_ssl_set_tmp_dh: allocate DerBuffer with actual size and copy data instead of pointing at caller's const buffer, which caused FreeDer to free non-owned memory.
2026-04-13 11:32:51 -06:00
4594f3f275
Copy-paste error in ProcessBufferCertPublicKey and ProcessBufferCertAltPublicKey, Fix #endif comments closing WOLFSSL_SM2/SM3 blocks, not HAVE_ED25519
2026-04-13 11:32:51 -06:00
2a0d76cf63
Fix DH encoding check in wolfSSL_CTX_set_tmp_dh: && to || and < to <= to catch single-param failure and zero-length, matching wolfSSL_set_tmp_dh.
2026-04-13 11:32:51 -06:00
886ca031d0
Fix == vs = in wolfSSL_add1_chain_cert so ret captures up_ref result instead of comparing against it, matching wolfSSL_CTX_add1_chain_cert
2026-04-13 11:32:51 -06:00
0a152dd482
Fix inverted AllocDer success check in wolfSSL_use_AltPrivateKey_Label
2026-04-13 11:32:51 -06:00
b74731d878
Add test for wolfSSL_use_AltPrivateKey_Label to verify successful key label allocation
2026-04-13 11:32:51 -06:00
72c1dd7290
Fix inverted AllocDer success check in wolfSSL_use_AltPrivateKey_Id
2026-04-13 11:32:51 -06:00
3925804da6
Add test for wolfSSL_use_AltPrivateKey_Id to verify successful key ID allocation
2026-04-13 11:32:50 -06:00
178e10e42a
Merge pull request #10081 from julek-wolfssl/openssh-10.2p1
...
Add openssh 10.2p1 to CI
2026-04-13 10:21:50 -07:00
cfd763722a
Rework rsa accel a bit and turn it back on.
2026-04-13 13:18:06 -04:00
a67179e3c5
Merge pull request #10202 from LinuxJedi/fix-gha-cache
...
ci: rebuild mbedtls/nss in test job on cache miss
2026-04-13 10:02:04 -07:00
c4e7198686
Merge pull request #10070 from holtrop-wolfssl/rust-rand_core-aead-cipher
...
Rust wrapper: add rand_core, aead, cipher trait implementations
2026-04-13 10:00:26 -07:00
c36beba9b7
Merge pull request #10174 from SparkiDev/api_test_cipher_algs_1
...
API testing additions: cipher tests
2026-04-13 09:54:23 -07:00
bf492eba12
Merge pull request #10175 from yosuke-wolfssl/f_2205
...
Fix authTagSz validation
2026-04-13 09:33:14 -07:00
0525301b75
test non-block-aligned CBC input rejected
2026-04-13 16:19:30 +00:00
e73b255cbc
Merge pull request #10194 from douzzer/20260410-linuxkm-aes-ccm
...
20260410-linuxkm-aes-ccm
2026-04-13 09:19:17 -07:00
3aa9a58b74
move length check before dispatch
2026-04-13 15:52:45 +00:00
a77e1ff5ac
reject non-block-aligned CBC cipher input
2026-04-13 15:50:52 +00:00
362eda5b25
add NULL checks to Base64 encode/decode
2026-04-13 15:50:52 +00:00
Tobias Frauenschläger
Reda Chouk
Mattia Moffa
Zackery Backman
Lealem Amedie
Colton Willey
Sean Parkinson
Joseph Chen
Daniel Pouzzner
David Garske
Masaki Iwai
Eric Blankenhorn
Anthony Hu
sebastian-carpenter
Thomas Cook
Jeremiah Mackey