Tobias Frauenschläger fa2faecdf9 Bound Renesas crypt callback context slot allocation ...

wc_CryptoCb_CryptInitRenesasCmn() derived the slot index from a
free-running device id counter and wrote gCbCtx[] without checking the
index against MAX_FSPSM_CBINDEX. Since the function is called once per
WOLFSSL session, the sixth registration in the lifetime of a process
wrote a pointer past the end of the array.

Look for a free slot inside the hardware lock instead and derive the
device id from that slot, so a full table is rejected with
INVALID_DEVID. wc_CryptoCb_CleanupRenesasCmn() now clears the slot,
which makes it available to a later registration and drops the stale
pointer to a context the application may free. Also correct the upper
bound checks in Renesas_cmn_GetCbCtxBydevId() and
wc_CryptoCb_CleanupRenesasCmn(), which both accepted an index one past
the last element.

Fixes F-7438.

2026-08-07 08:11:23 +02:00

..

benchmark

wolfcrypt/src/falcon.c, configure.ac, wolfcrypt/benchmark/benchmark.c, wolfcrypt/test/test.h, wolfcrypt/test/test.c: Falcon fixes and cleanups:

2026-08-05 13:53:46 -05:00

src

Bound Renesas crypt callback context slot allocation

2026-08-07 08:11:23 +02:00

test

linuxkm/linuxkm_wc_port.h, linuxkm/x86_vector_register_glue.c, wolfcrypt/test/test.c: implement DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_{ON,OFF}, to allow forcing of asm and C paths for kernel module testing.

2026-08-06 18:20:30 -05:00