mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-18 16:33:22 +02:00
Tobias Frauenschläger
8e61a110ca
In a small stack build wc_SrpComputeKey allocates six objects up front and checks them together afterwards, so a failure of any one of them jumps to the cleanup with the others allocated but not yet passed through mp_init_multi. The cleanup decided whether to zeroize the four temporaries by testing the return code against MP_INIT_E, which does not hold on the allocation failure path, so it called mp_forcezero on uninitialized memory. That takes its length from the size field of the object being zeroized, so an unset field turns into a write of arbitrary length past the end of the allocation. Track whether mp_init_multi succeeded and gate the zeroize on that instead. The flag is only set once the objects really are initialized, so it covers the init failure case the return code test was aiming at as well. Add a regression test that fails the last of the six allocations through a custom allocator and requires the call to report a memory error without touching the objects it never initialized. Fixes F-7084.