From 7c02c503eab4508930736475136bafc4762493cb Mon Sep 17 00:00:00 2001 From: Andres Amaya Garcia Date: Fri, 4 Aug 2017 13:32:15 +0100 Subject: [PATCH 1/2] Change PK module preprocessor check on word size There were preprocessor directives in pk.c and pk_wrap.c that cheked whether the bit length of size_t was greater than that of unsigned int. However, the check relied on the MBEDTLS_HAVE_INT64 macro being defined which is not directly related to size_t. This might result in errors in some platforms. This change modifies the check to use the macros SIZE_MAX and UINT_MAX instead making the code more robust. --- library/pk.c | 7 +++---- library/pk_wrap.c | 14 +++++++------- 2 files changed, 10 insertions(+), 11 deletions(-) diff --git a/library/pk.c b/library/pk.c index 8d13bc5ce..b52c73fbc 100644 --- a/library/pk.c +++ b/library/pk.c @@ -29,8 +29,6 @@ #include "mbedtls/pk.h" #include "mbedtls/pk_internal.h" -#include "mbedtls/bignum.h" - #if defined(MBEDTLS_RSA_C) #include "mbedtls/rsa.h" #endif @@ -42,6 +40,7 @@ #endif #include +#include /* Implementation that should never be optimized out by the compiler */ static void mbedtls_zeroize( void *v, size_t n ) { @@ -213,10 +212,10 @@ int mbedtls_pk_verify_ext( mbedtls_pk_type_t type, const void *options, int ret; const mbedtls_pk_rsassa_pss_options *pss_opts; -#if defined(MBEDTLS_HAVE_INT64) +#if SIZE_MAX > UINT_MAX if( md_alg == MBEDTLS_MD_NONE && UINT_MAX < hash_len ) return( MBEDTLS_ERR_PK_BAD_INPUT_DATA ); -#endif /* MBEDTLS_HAVE_INT64 */ +#endif /* SIZE_MAX > UINT_MAX */ if( options == NULL ) return( MBEDTLS_ERR_PK_BAD_INPUT_DATA ); diff --git a/library/pk_wrap.c b/library/pk_wrap.c index db6274cbf..2c164b7df 100644 --- a/library/pk_wrap.c +++ b/library/pk_wrap.c @@ -30,7 +30,6 @@ /* Even if RSA not activated, for the sake of RSA-alt */ #include "mbedtls/rsa.h" -#include "mbedtls/bignum.h" #include @@ -51,6 +50,7 @@ #endif #include +#include #if defined(MBEDTLS_PK_RSA_ALT_SUPPORT) /* Implementation that should never be optimized out by the compiler */ @@ -77,10 +77,10 @@ static int rsa_verify_wrap( void *ctx, mbedtls_md_type_t md_alg, { int ret; -#if defined(MBEDTLS_HAVE_INT64) +#if SIZE_MAX > UINT_MAX if( md_alg == MBEDTLS_MD_NONE && UINT_MAX < hash_len ) return( MBEDTLS_ERR_PK_BAD_INPUT_DATA ); -#endif /* MBEDTLS_HAVE_INT64 */ +#endif /* SIZE_MAX > UINT_MAX */ if( sig_len < ((mbedtls_rsa_context *) ctx)->len ) return( MBEDTLS_ERR_RSA_VERIFY_FAILED ); @@ -101,10 +101,10 @@ static int rsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg, unsigned char *sig, size_t *sig_len, int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ) { -#if defined(MBEDTLS_HAVE_INT64) +#if SIZE_MAX > UINT_MAX if( md_alg == MBEDTLS_MD_NONE && UINT_MAX < hash_len ) return( MBEDTLS_ERR_PK_BAD_INPUT_DATA ); -#endif /* MBEDTLS_HAVE_INT64 */ +#endif /* SIZE_MAX > UINT_MAX */ *sig_len = ((mbedtls_rsa_context *) ctx)->len; @@ -415,10 +415,10 @@ static int rsa_alt_sign_wrap( void *ctx, mbedtls_md_type_t md_alg, { mbedtls_rsa_alt_context *rsa_alt = (mbedtls_rsa_alt_context *) ctx; -#if defined(MBEDTLS_HAVE_INT64) +#if SIZE_MAX > UINT_MAX if( UINT_MAX < hash_len ) return( MBEDTLS_ERR_PK_BAD_INPUT_DATA ); -#endif /* MBEDTLS_HAVE_INT64 */ +#endif /* SIZE_MAX > UINT_MAX */ *sig_len = rsa_alt->key_len_func( rsa_alt->key ); From b592f322913580ba10ff469ab49c92f54020c1bb Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 1 Dec 2017 23:30:43 +0100 Subject: [PATCH 2/2] Added ChangeLog entry --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index e8d1da5c9..7fa5389ec 100644 --- a/ChangeLog +++ b/ChangeLog @@ -41,6 +41,7 @@ Bugfix * Fix a potential integer overflow in the version verification for DER encoded X509 certificates. The overflow would enable maliciously constructed certificates to bypass the certificate verification check. + * Fix word size check in in pk.c to not depend on MBEDTLS_HAVE_INT64. Changes * Added config.h option MBEDTLS_NO_UDBL_DIVISION, to prevent the use of