ef3ba4906b
Merge pull request #10109 from julek-wolfssl/openvpn-master
...
Fix GetLength return value check in ASN1_INTEGER functions
2026-03-31 11:23:11 -05:00
4c2a90c8ef
Fix GetLength return value check in ASN1_INTEGER functions
...
Change GetLength() return check from > 0 to >= 0 in wolfSSL_ASN1_INTEGER_get_length
and wolfSSL_ASN1_INTEGER_get0_data. GetLength returns the decoded length (≥ 0) on
success and negative error codes on failure, so checking > 0 incorrectly excluded
zero-length values, making the DER-stripping logic dead code.
2026-03-31 12:44:30 +02:00
b36a9ca80e
Merge pull request #10032 from JacobBarthelmeh/changelog
...
minor formatting fixes to changelog
2026-03-30 23:01:35 -05:00
a2298dde9c
Merge pull request #10105 from padelsbach/lms-sign-external
...
Add buffer size and callback checks to external wc_LmsKey_Sign
2026-03-30 23:01:00 -05:00
5f54de0577
Merge pull request #10076 from rizlik/dtls13_ack_improvements
...
Dtls13: ack management improvements
2026-03-30 22:59:54 -05:00
1a3daf0148
Merge pull request #10087 from padelsbach/crl-num-negative
...
Reject negative CRL numbers when decoding
2026-03-30 22:58:34 -05:00
adf70b1629
Merge pull request #10089 from julek-wolfssl/openvpn-master
...
openssl compat: fix ASN1_STRING_{length,get0_data} for ASN1_INTEGER
2026-03-30 22:52:36 -05:00
8e54eb9364
Merge pull request #10048 from anhu/constraints
...
Enforce URI name constraints in ConfirmNameConstraints
2026-03-30 22:51:52 -05:00
74a407939b
Merge pull request #10093 from lealem47/ocsp_hang
...
Fix hang in OCSP Stapling test
2026-03-30 22:50:44 -05:00
c8415c407f
Merge pull request #10100 from Frauschi/zd21464
...
Zeroize sensitive buffers for ML-DSA
2026-03-30 22:34:53 -05:00
b5a835abed
Merge pull request #10054 from kojo1/Csharp
...
fix for Csharp user_settings.h
2026-03-30 18:32:19 -05:00
18494e154f
Reject negative CRL numbers when decoding
2026-03-30 16:09:32 -07:00
2ac3020bb6
Add buffer size and callback checks to external wc_LmsKey_Sign
2026-03-30 15:02:13 -07:00
0a61997059
Merge pull request #10045 from embhorn/zd21385
...
Fix IAR warning about volatile access
2026-03-30 13:42:14 -05:00
5b2e8b1376
Merge pull request #10065 from dgarske/async_nb_leak
...
Fix possible leak for ecc non-blocking crypto
2026-03-30 11:40:02 -05:00
edb4b2828f
Merge pull request #10091 from rlm2002/gi10063Xchacha
...
GI issue fix use `size_t` instead of `long int`
2026-03-30 11:38:32 -05:00
18111b1252
Merge pull request #10092 from anhu/hkex-ticket
...
Fix PQC hybrid KeyShare pointer sanity.
2026-03-30 11:36:11 -05:00
df055976ed
Merge pull request #10079 from rlm2002/ghi10063
...
Various GI and ZD fixes
2026-03-30 11:34:05 -05:00
9c0a9a6ceb
Merge pull request #10084 from holtrop-wolfssl/zd21439
...
Add buffer size and callback checks to wc_LmsKey_Sign
2026-03-30 11:32:38 -05:00
348d75b749
Merge pull request #10098 from douzzer/20260328-test_wolfSSL_dtls_fragments-race-mitigation
...
20260328-test_wolfSSL_dtls_fragments-race-mitigation
2026-03-30 10:29:31 -06:00
1496614579
internal.h: clarify DTLS13_ACK_MAX_RECORDS comment
2026-03-30 17:34:36 +02:00
d1d6e587c0
test_dtls: remove bad char
2026-03-30 16:53:07 +02:00
7bdf13a3a3
Zeroize sensitive buffers for ML-DSA
...
Make sure stack-allocated buffers containing potentially senstive
material are zeroized before function exit.
Identified by: Abhinav Agarwal (GitHub: @abhinavagarwal07)
2026-03-30 11:21:32 +02:00
20d9ea0022
tests/api.c: in test_wolfSSL_dtls_fragments(), accommodate races between threads.
2026-03-28 16:25:41 -05:00
b7e7e7555f
Merge pull request #10095 from douzzer/20260327-sanitizer-and-fixes-and-tls12_kdf_test-gating
...
20260327-sanitizer-and-tls12_kdf_test-gating-fixes
2026-03-27 17:52:37 -06:00
22717a4672
Address copilot feedback
2026-03-27 16:35:42 -06:00
76a498f7ea
wolfcrypt/src/asn.c: fix invalid-pointer-pair "wild pointer" in CheckCertSignature_ex().
2026-03-27 17:07:53 -05:00
8b84b1fd1b
wolfssl/wolfcrypt/coding.h and wolfssl/wolfcrypt/settings.h: fix feature activation for WOLFSSL_BASE16 (move from coding.h to settings.h).
2026-03-27 16:42:25 -05:00
e3d4d220c3
src/conf.c, src/ssl.c, wolfcrypt/src/asn.c, wolfssl/wolfcrypt/asn.h: fixes for invalid-pointer-pair memory errors reported by clang sanitizer with detect_invalid_pointer_pairs=2 in ASAN_OPTIONS.
2026-03-27 16:40:05 -05:00
49003f8e54
Fix hang in OCSP test
2026-03-27 14:41:24 -06:00
46f6320380
Fix PQC hybrid KeyShare pointer sanity.
...
Also add tests for it and SetTicket
2026-03-27 14:33:41 -04:00
88fdc3d92a
remove casts that would cause truncation if long int is 32-bit but size_t is 64-bit
2026-03-27 12:09:53 -06:00
0f30790c9b
openssl compat: fix ASN1_STRING_{length,get0_data} for ASN1_INTEGER
...
In OpenSSL, ASN1_INTEGER is typedef'd to ASN1_STRING (same struct), so
calling ASN1_STRING_length() / ASN1_STRING_get0_data() on an
ASN1_INTEGER* is valid and well-defined. wolfSSL has them as distinct,
incompatible structs. This fixes the openvpn master failures introduced in
https://github.com/OpenVPN/openvpn/pull/1003
2026-03-27 17:20:45 +01:00
048a03e8bf
Add buffer size and callback checks to wc_LmsKey_Sign
...
Fixes ZD#21439
2026-03-27 08:49:43 -04:00
5b1d2d795c
Merge pull request #10086 from douzzer/20260326-various-fixes
...
20260326-various-fixes
2026-03-26 20:28:46 -07:00
8b2fd34e95
free authInPadded if alloc'd on early return
2026-03-26 16:11:19 -06:00
a827a82ed3
return null if len<=0
2026-03-26 16:11:19 -06:00
53f3ce635e
wolfcrypt/src/asn.c: fix flub in wc_EccPublicKeyDecode() -- restore FREE_ASNGETDATA(dataASN, key->heap).
2026-03-26 16:54:19 -05:00
f0b711045c
wolfssl/wolfcrypt/types.h: restore WC_ALLOC_DO_ON_FAILURE fallback definition from 760178c7dc -- reversion in part of 5f4d499df0. fixes optest build failures in all-crypto-only-intelasm-fips-v5-linuxkm-next-insmod-optest, all-crypto-only-intelasm-fips-v6-linuxkm-next-insmod-optest, and all-crypto-only-intelasm-fips-dev-linuxkm-next-insmod-optest.
2026-03-26 16:28:18 -05:00
292ea549cc
wolfcrypt/src/asn.c: fixes for invalid memory access in wc_DsaPublicKeyDecode() and wc_EccPublicKeyDecode(), detected by cppcheck-force-source, lms-xmss-wolfssl-all-clang-sanitizer, and sanitizer-clang-all-noasm.
2026-03-26 16:07:37 -05:00
52d5d0a940
linuxkm/, wolfcrypt/src/dh.c, wolfcrypt/test/test.c, wolfcrypt/test/test.h, wolfssl/wolfcrypt/wc_port.h:
...
fixes and workarounds for clang-tidy complaints:
* clang-diagnostic-unknown-warning-option
* bugprone-sizeof-expression
* clang-diagnostic-error "address argument to atomic operation must be a pointer to a trivially-copyable type"
* bugprone-macro-parentheses
* clang-diagnostic-unused-but-set-variable
* readability-redundant-declaration
2026-03-26 15:41:47 -05:00
ce7b81b6ee
break when idx greater than MAX_CHAIN_DEPTH
2026-03-26 11:28:36 -06:00
a963c5fc47
add check to prevent integer underflow
2026-03-26 11:28:36 -06:00
a696d11519
if len is 0, do not subtract 1 when calling XMALLOC
2026-03-26 11:28:36 -06:00
1766b91dc2
check idx before accessing certificate list
2026-03-26 11:28:36 -06:00
3bc72b5d27
bounds check when parsing dual-algo cert sigs
2026-03-26 11:28:36 -06:00
14695fb9cd
zeroize ssl->encrypt after transferring ownership to dup
2026-03-26 11:28:36 -06:00
75e6406cd3
upper bounds check for DSA signature
2026-03-26 11:28:36 -06:00
d4b25d0ebc
guard against heap buffer overflow
2026-03-26 11:28:36 -06:00
1aa1cec3f2
dtls13: limit max number of ack records to 128
2026-03-26 18:25:48 +01:00
Daniel Pouzzner
Juliusz Sosinowicz
Paul Adelsbach
JacobBarthelmeh
Marco Oliverio
Tobias Frauenschläger
lealem47
Lealem Amedie
Anthony Hu
Ruby Martin
Josh Holtrop