wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-07-07 00:30:51 +02:00
Code Issues Packages Projects Releases Wiki Activity
30,243 Commits 13 Branches 184 Tags
ea5e86d967af5e2fe86c6cff8ca82fcea36d9d26
Commit Graph

30243 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Daniel Pouzzner ea5e86d967 fix F-5956: Heap buffer overflow in DH/FFDHE shared-secret computation when peer public key is shorter than the modulus 2026-06-15 12:28:23 -05:00
David Garske cc6887ffe8 Merge pull request #10684 from julek-wolfssl/parallel-make-check-warn-stale-minutes 
parallel-make-check: warn when a job runtime drifts >50% from "minutes"
 2026-06-15 09:19:08 -07:00
David Garske 8ef48f3188 Merge pull request #10683 from Frauschi/zd21977 
Add missing ForceZero
 2026-06-15 07:48:14 -07:00
Juliusz Sosinowicz ea3bd56e97 parallel-make-check: fix warning-doc wording and escape every workflow command 
Addresses review feedback:
- The "minutes" header comment described the check backwards (the
  estimate drifting from the measured time). Reword it to match the
  code, which warns when the measured time lands more than +/-50% away
  from the estimate.
- Centralize the GitHub workflow-command escaping in gh_escape() and
  apply it to the ::group:: title in dump() and the ::error:: summary in
  main(), not just warn(), so a config name or step carrying %, CR or LF
  cannot corrupt those commands either.
 2026-06-15 11:30:00 +00:00
Juliusz Sosinowicz d9079978ed parallel-make-check: percent-encode warn() workflow-command data 
A config name comes from JSON and is only checked for emptiness and a
'/', so it can carry %, CR or LF. Passed straight into the ::warning::
workflow command those would truncate the annotation or be parsed as a
second command, so escape them in the GitHub branch of warn() per
GitHub's documented command-data encoding (% first). Local output is
unchanged.
 2026-06-15 11:14:06 +00:00
Tobias Frauenschläger d4eedf8af8 Add missing ForceZero call for ML-DSA 2026-06-15 12:07:00 +02:00
Tobias Frauenschläger e43281b2dc Add missing ForceZero calls for ML-KEM 2026-06-15 12:06:55 +02:00
Juliusz Sosinowicz 7b2d19ca86 parallel-make-check: warn when a job runtime drifts >50% from "minutes" 
The "minutes" field is only a scheduling estimate; when it goes stale it
just packs the schedule a little worse, and there was no signal that a
value needed updating. Emit a non-fatal warning when a config that
explicitly sets "minutes" finishes more than 50% above or below it (a
GitHub ::warning:: annotation in CI, a plain line locally) and flag the
row in the step-summary table with the value to copy over.

Configs that omit "minutes" keep riding the 1.0 default and are left
alone. The warning never touches the exit status, so it cannot fail the
job.
 2026-06-15 08:36:04 +00:00
David Garske 68381e0197 Merge pull request #10680 from michael-membrowse/skip_membrowse_comment 
skip membrowse comment action on draft PRs
 2026-06-13 19:18:23 -07:00
David Garske e8b88643ba Merge pull request #10681 from douzzer/20260613-linuxkm-fix-fips-random-seed 
20260613-linuxkm-fix-fips-random-seed
 2026-06-13 19:18:08 -07:00
Daniel Pouzzner 70e7bf5eab linuxkm/linuxkm_wc_port.h: fix entropy source setup for FIPS: use in-boundary wc_GenerateSeed() unless FIPS < 5.2.4 or explicit WC_LINUXKM_WOLFENTROPY_IN_GLUE_LAYER / WC_LINUXKM_RDSEED_IN_GLUE_LAYER. 2026-06-13 10:48:02 -05:00
David Garske 6b9949ed4a Merge pull request #10676 from douzzer/20260610-linuxkm-fenrir 
20260610-linuxkm-fenrir
 2026-06-13 08:19:19 -07:00
Michael Rogov Papernov f30cbd4606 skip membrowse comment action on draft PRs 2026-06-13 11:59:58 +01:00
Daniel Pouzzner 4d77baff3b linuxkm/module_hooks.c: fix flub in IntelRDseed64_r() ForceZero() call; 
linuxkm/lkcapi_aes_glue.c: fix typo in linuxkm_test_aesgcm() error message.
 2026-06-12 19:24:32 -05:00
David Garske f42a698c59 Merge pull request #10668 from holtrop-wolfssl/f-5394 
Force-zero wc_AesSivDecrypt*() output buffer on authentication failure
 2026-06-12 16:35:31 -07:00
Daniel Pouzzner 1b22e4b502 fix F-4409: Integer Overflow in PKCS1 Sign Length Check Allows Heap Buffer Overflow 2026-06-12 18:14:55 -05:00
Daniel Pouzzner 8624bca5b5 fix F-3294: IntelRDseed64_r Stack Buffer Containing Entropy Cleared with Plain Assignment Instead of wc_ForceZero 2026-06-12 18:14:54 -05:00
Daniel Pouzzner 476cfd6c64 fix for F-3946: Missing ForceZero on Heap-Allocated HMAC State Buffer in km_hmac_init Error Path 2026-06-12 18:14:54 -05:00
Daniel Pouzzner d3279a825a fixes for 
F-1433: AES CBC/CFB Self-Test Functions Silently Continue After enc2/dec2 Allocation Failure
F-1434: linuxkm_test_aesgcm Silently Returns Success on Kernel Crypto Allocation Failure
 2026-06-12 18:14:54 -05:00
Daniel Pouzzner 503084629f fix F-1430: AES-GCM Non-Stream Path Returns -EINVAL Instead of Propagating skcipher_walk Error 2026-06-12 18:14:54 -05:00
Daniel Pouzzner ab69af541f fixes for 
F-1428: Missing ForceZero on sg_buf Containing Decrypted Plaintext in AES-GCM Non-Stream Path
F-3293: AES-CCM Non-Contiguous SG Path Missing ForceZero on sg_buf Containing Decrypted Plaintext
 2026-06-12 18:14:53 -05:00
Daniel Pouzzner c071c29eca fixes for Skoll-flagged linuxkm/ flubs in #10658: 
in AesGcmCrypt_1() and AesCcmCrypt_1(), check for overflow on assoclen+cryptlen in both encrypt and decrypt modes;

in linuxkm_test_kpp_driver(), return MEMORY_E, not -ENOMEM;

in km_direct_rsa_dec(), only update req->dst_len for -EOVERFLOW, not for -EINVAL.
 2026-06-12 18:14:53 -05:00
Daniel Pouzzner c84c44f62f fix F-1238: Integer Overflow in ECDSA Verify Allocation of sig_len + hash_len 2026-06-12 18:14:53 -05:00
Daniel Pouzzner 0272f0a506 fix F-709: AES-XTS Stream Finalize Returns Untranslated wolfCrypt Error Code to Kernel LKCAPI 2026-06-12 18:14:52 -05:00
Daniel Pouzzner 8110d567c8 fix F-708: DH km_dh_set_secret Missing Private Key Cleanup on Error Path 2026-06-12 18:14:52 -05:00
Daniel Pouzzner 591f52fb9b fix F-681: DH/FFDHE Init Error Paths Leak RNG Resource 2026-06-12 18:14:52 -05:00
Daniel Pouzzner ec4146a8e3 fix F-680: ECDH Init Error Paths Leak RNG Resource 2026-06-12 18:14:51 -05:00
Daniel Pouzzner cac0f231db fix F-679: HMAC Finup Memory Leak on Update Failure 2026-06-12 18:14:51 -05:00
Daniel Pouzzner 3057314f65 fix F-678: SHA3 Finup Memory Leak on Update Failure 2026-06-12 18:14:51 -05:00
Daniel Pouzzner 38c2477cbb fix F-677: SHA3 Init Memory Leak on wc_InitSha3 Failure 2026-06-12 18:14:51 -05:00
Daniel Pouzzner 85091c7d06 fix F-676: Missing ForceZero on RSA Decrypted Plaintext Buffer 
also ForceZeros various other potentially sensitive allocations before freeing them, and uses unconditional free() per current libwolfssl best practice.
 2026-06-12 18:14:50 -05:00
Daniel Pouzzner 1df8d453c9 fix F-3948: Missing KAT mismatch check in aes_xts_256_test partial block encrypt path 2026-06-12 18:14:50 -05:00
Daniel Pouzzner 21a57cf003 Fixes for Fenrir items: 
F-1880: Unsigned word32 dec_len Silently Wraps Negative wc_RsaSSL_Verify Error Codes, Returning Wrong Errno on RSA Signature Verification Failure
F-1881: word32 sig_len Silently Wraps Negative wc_RsaSSL_Sign Error in Self-Test Functions, Bypassing <= 0 Guard
F-1882: word32 priv_len / pub_len Silently Wrap Negative wc_RsaKeyToDer / wc_RsaKeyToPublicDer Errors Across Three RSA Self-Test Functions
 2026-06-12 18:14:50 -05:00
Daniel Pouzzner b3cb06e98a fix F-1426: PTR_ERR on malloc Results Always Yields 0 in AES-GCM Self-Test Error Messages 2026-06-12 18:14:50 -05:00
Daniel Pouzzner 8c1013ad52 fix F-1425: PTR_ERR on malloc Result Always Yields 0 in Error Message 2026-06-12 18:14:49 -05:00
Daniel Pouzzner 682a09d5a7 fix F-1424: Sysfs Node Resource Leak When Second Install Fails 2026-06-12 18:14:49 -05:00
Daniel Pouzzner f48efe5bfc fix F-705: Missing wc_RsaSetRNG in sig_alg km_pkcs1_set_pub After Key Re-Init 2026-06-12 18:14:49 -05:00
Daniel Pouzzner 9c1d9c164b fix F-673: Wrong sizeof Type in Allocation Failure Error Message 2026-06-12 18:14:48 -05:00
Daniel Pouzzner 1c9abac6f5 fix F-672: Copy-Paste Duplicate: pkcs1_sha384 Unregistered Twice in Both RSA Paths 2026-06-12 18:14:48 -05:00
Daniel Pouzzner 546ac0ac36 linuxkm/lkcapi_aes_glue.c: clean up pr_err()s on allocation failures. 2026-06-12 18:14:48 -05:00
JacobBarthelmeh 86ba8f7770 Merge pull request #10652 from SparkiDev/regression_fixes_25 
Regression testing fixes - memory allocation failure testing
 2026-06-12 16:30:57 -06:00
David Garske bfef92c343 Merge pull request #10656 from holtrop-wolfssl/f-4427 
Ed448: check for public key presence on export
 2026-06-12 15:30:07 -07:00
David Garske e4b7b67f06 Merge pull request #10674 from Frauschi/cert_chain_fix 
Fixes for OpenSSL compatibility layer
 2026-06-12 14:10:13 -07:00
Josh Holtrop 445b8b272c Document PUBLIC_KEY_E return value for wc_ed448_export_public() in source comment 2026-06-12 15:58:27 -04:00
Josh Holtrop 8c1e3a261f Fix Ed448/25519 export private-only key unit tests for FIPS pre-v7 2026-06-12 15:58:27 -04:00
Josh Holtrop daa22e9fb9 Document PUBLIC_KEY_E return for wc_ed448_export_public() 2026-06-12 15:58:27 -04:00
Josh Holtrop 955ffb92d3 Free RNG from updated Ed448/Ed25519 unit tests 2026-06-12 15:58:27 -04:00
Josh Holtrop 2914a85741 Document PUBLIC_KEY_E error return from wc_edXXX_export_key() 2026-06-12 15:58:27 -04:00
Josh Holtrop 92500e728f Preserve Ed25519/448 PublicKeyToDer unit testing for BUFFER_E 2026-06-12 15:58:27 -04:00
Josh Holtrop 6270029cc4 Fix wc_Ed25519PublicKeyToDer doxygen documentation 2026-06-12 15:58:27 -04:00