Skip to content

Commit 847f3d6

Browse files
FrauschiFrauschi
committed
Make sure large buffers are on the heap with SMALL_STACK
1 parent fa9f24f commit 847f3d6

18 files changed

Lines changed: 359 additions & 173 deletions

File tree

‎src/conf.c‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@
3131
* START OF TXT_DB API
3232
******************************************************************************/
3333

34+
#define LINE_BUFFER_SIZE 512 /* enough for a single row */
35+
3436
#if defined(OPENSSL_ALL) && !defined(NO_BIO)
3537
/**
3638
* This function reads a tab delimetered CSV input and returns
@@ -149,8 +151,8 @@ long wolfSSL_TXT_DB_write(WOLFSSL_BIO *out, WOLFSSL_TXT_DB *db)
149151
{
150152
const WOLF_STACK_OF(WOLFSSL_STRING)* data;
151153
long totalLen = 0;
152-
char buf[512]; /* Should be more than enough for a single row */
153-
char* bufEnd = buf + sizeof(buf);
154+
WC_DECLARE_VAR(buf, char, LINE_BUFFER_SIZE, NULL); /* enough for a single row */
155+
char* bufEnd;
154156
int i;
155157

156158
WOLFSSL_ENTER("wolfSSL_TXT_DB_write");
@@ -160,6 +162,10 @@ long wolfSSL_TXT_DB_write(WOLFSSL_BIO *out, WOLFSSL_TXT_DB *db)
160162
return WOLFSSL_FAILURE;
161163
}
162164

165+
WC_ALLOC_VAR_EX(buf, char, LINE_BUFFER_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER,
166+
return WOLFSSL_FAILURE);
167+
bufEnd = buf + LINE_BUFFER_SIZE;
168+
163169
data = db->data;
164170
while (data) {
165171
char** fields = (char**)data->data.string;
@@ -168,6 +174,7 @@ long wolfSSL_TXT_DB_write(WOLFSSL_BIO *out, WOLFSSL_TXT_DB *db)
168174

169175
if (!fields) {
170176
WOLFSSL_MSG("Missing row");
177+
WC_FREE_VAR_EX(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
171178
return WOLFSSL_FAILURE;
172179
}
173180

@@ -186,6 +193,7 @@ long wolfSSL_TXT_DB_write(WOLFSSL_BIO *out, WOLFSSL_TXT_DB *db)
186193
}
187194
else {
188195
WOLFSSL_MSG("Data row is too big");
196+
WC_FREE_VAR_EX(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
189197
return WOLFSSL_FAILURE;
190198
}
191199
}
@@ -194,24 +202,29 @@ long wolfSSL_TXT_DB_write(WOLFSSL_BIO *out, WOLFSSL_TXT_DB *db)
194202
}
195203
else {
196204
WOLFSSL_MSG("Data row is too big");
205+
WC_FREE_VAR_EX(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
197206
return WOLFSSL_FAILURE;
198207
}
199208
}
200209
if (idx > buf)
201210
idx[-1] = '\n';
202-
else
211+
else {
212+
WC_FREE_VAR_EX(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
203213
return WOLFSSL_FAILURE;
214+
}
204215
sz = (int)(idx - buf);
205216

206217
if (wolfSSL_BIO_write(out, buf, sz) != sz) {
207218
WOLFSSL_MSG("wolfSSL_BIO_write error");
219+
WC_FREE_VAR_EX(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
208220
return WOLFSSL_FAILURE;
209221
}
210222
totalLen += sz;
211223

212224
data = data->next;
213225
}
214226

227+
WC_FREE_VAR_EX(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
215228
return totalLen;
216229
}
217230

‎src/dtls.c‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -212,46 +212,50 @@ static int CreateDtls12Cookie(const WOLFSSL* ssl, const WolfSSL_CH* ch,
212212
byte* cookie)
213213
{
214214
int ret;
215-
Hmac cookieHmac;
215+
WC_DECLARE_VAR(cookieHmac, Hmac, 1, ssl->heap);
216216

217217
if (ssl->buffers.dtlsCookieSecret.buffer == NULL ||
218218
ssl->buffers.dtlsCookieSecret.length == 0) {
219219
WOLFSSL_MSG("Missing DTLS 1.2 cookie secret");
220220
return COOKIE_ERROR;
221221
}
222222

223-
ret = wc_HmacInit(&cookieHmac, ssl->heap, ssl->devId);
223+
WC_ALLOC_VAR_EX(cookieHmac, Hmac, 1, ssl->heap, DYNAMIC_TYPE_HMAC,
224+
return MEMORY_E);
225+
226+
ret = wc_HmacInit(cookieHmac, ssl->heap, ssl->devId);
224227
if (ret == 0) {
225-
ret = wc_HmacSetKey(&cookieHmac, DTLS_COOKIE_TYPE,
228+
ret = wc_HmacSetKey(cookieHmac, DTLS_COOKIE_TYPE,
226229
ssl->buffers.dtlsCookieSecret.buffer,
227230
ssl->buffers.dtlsCookieSecret.length);
228231
if (ret == 0) {
229232
/* peerLock not necessary. Still in handshake phase. */
230-
ret = wc_HmacUpdate(&cookieHmac,
233+
ret = wc_HmacUpdate(cookieHmac,
231234
(const byte*)ssl->buffers.dtlsCtx.peer.sa,
232235
ssl->buffers.dtlsCtx.peer.sz);
233236
}
234237
if (ret == 0)
235-
ret = wc_HmacUpdate(&cookieHmac, (byte*)ch->pv, OPAQUE16_LEN);
238+
ret = wc_HmacUpdate(cookieHmac, (byte*)ch->pv, OPAQUE16_LEN);
236239
if (ret == 0)
237-
ret = wc_HmacUpdate(&cookieHmac, (byte*)ch->random, RAN_LEN);
240+
ret = wc_HmacUpdate(cookieHmac, (byte*)ch->random, RAN_LEN);
238241
if (ret == 0) {
239-
ret = wc_HmacUpdate(&cookieHmac, (byte*)ch->sessionId.elements,
242+
ret = wc_HmacUpdate(cookieHmac, (byte*)ch->sessionId.elements,
240243
ch->sessionId.size);
241244
}
242245
if (ret == 0) {
243-
ret = wc_HmacUpdate(&cookieHmac, (byte*)ch->cipherSuite.elements,
246+
ret = wc_HmacUpdate(cookieHmac, (byte*)ch->cipherSuite.elements,
244247
ch->cipherSuite.size);
245248
}
246249
if (ret == 0) {
247-
ret = wc_HmacUpdate(&cookieHmac, (byte*)ch->compression.elements,
250+
ret = wc_HmacUpdate(cookieHmac, (byte*)ch->compression.elements,
248251
ch->compression.size);
249252
}
250253
if (ret == 0)
251-
ret = wc_HmacFinal(&cookieHmac, cookie);
252-
wc_HmacFree(&cookieHmac);
254+
ret = wc_HmacFinal(cookieHmac, cookie);
255+
wc_HmacFree(cookieHmac);
253256
}
254257

258+
WC_FREE_VAR_EX(cookieHmac, ssl->heap, DYNAMIC_TYPE_HMAC);
255259
return ret;
256260
}
257261

‎src/dtls13.c‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -489,29 +489,33 @@ int Dtls13HashClientHello(const WOLFSSL* ssl, byte* hash, int* hashSz,
489489
/* msg_type(1) + length (3) */
490490
byte header[OPAQUE32_LEN];
491491
int ret;
492-
wc_HashAlg hashCtx;
492+
WC_DECLARE_VAR(hashCtx, wc_HashAlg, 1, ssl->heap);
493493
int type = wolfSSL_GetHmacType_ex(specs);
494494

495495
if (type < 0)
496496
return type;
497497

498+
WC_ALLOC_VAR_EX(hashCtx, wc_HashAlg, 1, ssl->heap, DYNAMIC_TYPE_HASHES,
499+
return MEMORY_E);
500+
498501
header[0] = (byte)client_hello;
499502
c32to24(length, header + 1);
500503

501-
ret = wc_HashInit_ex(&hashCtx, (enum wc_HashType)type, ssl->heap, ssl->devId);
504+
ret = wc_HashInit_ex(hashCtx, (enum wc_HashType)type, ssl->heap, ssl->devId);
502505
if (ret == 0) {
503-
ret = wc_HashUpdate(&hashCtx, (enum wc_HashType)type, header, OPAQUE32_LEN);
506+
ret = wc_HashUpdate(hashCtx, (enum wc_HashType)type, header, OPAQUE32_LEN);
504507
if (ret == 0)
505-
ret = wc_HashUpdate(&hashCtx, (enum wc_HashType)type, body, length);
508+
ret = wc_HashUpdate(hashCtx, (enum wc_HashType)type, body, length);
506509
if (ret == 0)
507-
ret = wc_HashFinal(&hashCtx, (enum wc_HashType)type, hash);
510+
ret = wc_HashFinal(hashCtx, (enum wc_HashType)type, hash);
508511
if (ret == 0) {
509512
*hashSz = wc_HashGetDigestSize((enum wc_HashType)type);
510513
if (*hashSz < 0)
511514
ret = *hashSz;
512515
}
513-
wc_HashFree(&hashCtx, (enum wc_HashType)type);
516+
wc_HashFree(hashCtx, (enum wc_HashType)type);
514517
}
518+
WC_FREE_VAR_EX(hashCtx, ssl->heap, DYNAMIC_TYPE_HASHES);
515519
return ret;
516520
}
517521

@@ -2131,8 +2135,10 @@ static const byte snLabel[SN_LABEL_SZ + 1] = "sn";
21312135
*/
21322136
int Dtls13DeriveSnKeys(WOLFSSL* ssl, int provision)
21332137
{
2134-
byte key_dig[MAX_PRF_DIG];
21352138
int ret = 0;
2139+
WC_DECLARE_VAR(key_dig, byte, MAX_PRF_DIG, ssl->heap);
2140+
WC_ALLOC_VAR_EX(key_dig, byte, MAX_PRF_DIG, ssl->heap, DYNAMIC_TYPE_DIGEST,
2141+
return MEMORY_E);
21362142

21372143
if (provision & PROVISION_CLIENT) {
21382144
WOLFSSL_MSG("Derive SN Client key");
@@ -2159,8 +2165,9 @@ int Dtls13DeriveSnKeys(WOLFSSL* ssl, int provision)
21592165
end:
21602166
ForceZero(key_dig, MAX_PRF_DIG);
21612167
#ifdef WOLFSSL_CHECK_MEM_ZERO
2162-
wc_MemZero_Check(key_dig, sizeof(key_dig));
2168+
wc_MemZero_Check(key_dig, MAX_PRF_DIG);
21632169
#endif
2170+
WC_FREE_VAR_EX(key_dig, ssl->heap, DYNAMIC_TYPE_DIGEST);
21642171
return ret;
21652172
}
21662173

‎src/ssl.c‎

Lines changed: 36 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -18602,55 +18602,75 @@ static int SetStaticEphemeralKey(WOLFSSL_CTX* ctx,
1860218602
#ifdef HAVE_ECC
1860318603
if (keyAlgo == WC_PK_TYPE_NONE) {
1860418604
word32 idx = 0;
18605-
ecc_key eccKey;
18606-
ret = wc_ecc_init_ex(&eccKey, heap, INVALID_DEVID);
18605+
WC_DECLARE_VAR(eccKey, ecc_key, 1, heap);
18606+
WC_ALLOC_VAR_EX(eccKey, ecc_key, 1, heap, DYNAMIC_TYPE_ECC,
18607+
ret = MEMORY_E);
18608+
if (ret == 0)
18609+
ret = wc_ecc_init_ex(eccKey, heap, INVALID_DEVID);
1860718610
if (ret == 0) {
18608-
ret = wc_EccPrivateKeyDecode(keyBuf, &idx, &eccKey, keySz);
18611+
ret = wc_EccPrivateKeyDecode(keyBuf, &idx, eccKey, keySz);
1860918612
if (ret == 0)
1861018613
keyAlgo = WC_PK_TYPE_ECDH;
18611-
wc_ecc_free(&eccKey);
18614+
wc_ecc_free(eccKey);
18615+
ret = 0; /* clear error to enable key-type detect cascade */
1861218616
}
18617+
WC_FREE_VAR_EX(eccKey, heap, DYNAMIC_TYPE_ECC);
1861318618
}
1861418619
#endif
1861518620
#if !defined(NO_DH) && defined(WOLFSSL_DH_EXTRA)
1861618621
if (keyAlgo == WC_PK_TYPE_NONE) {
1861718622
word32 idx = 0;
18618-
DhKey dhKey;
18619-
ret = wc_InitDhKey_ex(&dhKey, heap, INVALID_DEVID);
18623+
WC_DECLARE_VAR(dhKey, DhKey, 1, heap);
18624+
WC_ALLOC_VAR_EX(dhKey, DhKey, 1, heap, DYNAMIC_TYPE_DH,
18625+
ret = MEMORY_E);
18626+
if (ret == 0)
18627+
ret = wc_InitDhKey_ex(dhKey, heap, INVALID_DEVID);
1862018628
if (ret == 0) {
18621-
ret = wc_DhKeyDecode(keyBuf, &idx, &dhKey, keySz);
18629+
ret = wc_DhKeyDecode(keyBuf, &idx, dhKey, keySz);
1862218630
if (ret == 0)
1862318631
keyAlgo = WC_PK_TYPE_DH;
18624-
wc_FreeDhKey(&dhKey);
18632+
wc_FreeDhKey(dhKey);
18633+
ret = 0; /* clear error to enable key-type detect cascade */
1862518634
}
18635+
WC_FREE_VAR_EX(dhKey, heap, DYNAMIC_TYPE_DH);
1862618636
}
1862718637
#endif
1862818638
#ifdef HAVE_CURVE25519
1862918639
if (keyAlgo == WC_PK_TYPE_NONE) {
1863018640
word32 idx = 0;
18631-
curve25519_key x25519Key;
18632-
ret = wc_curve25519_init_ex(&x25519Key, heap, INVALID_DEVID);
18641+
WC_DECLARE_VAR(x25519Key, curve25519_key, 1, heap);
18642+
WC_ALLOC_VAR_EX(x25519Key, curve25519_key, 1, heap,
18643+
DYNAMIC_TYPE_CURVE25519, ret = MEMORY_E);
18644+
if (ret == 0)
18645+
ret = wc_curve25519_init_ex(x25519Key, heap, INVALID_DEVID);
1863318646
if (ret == 0) {
1863418647
ret = wc_Curve25519PrivateKeyDecode(keyBuf, &idx,
18635-
&x25519Key, keySz);
18648+
x25519Key, keySz);
1863618649
if (ret == 0)
1863718650
keyAlgo = WC_PK_TYPE_CURVE25519;
18638-
wc_curve25519_free(&x25519Key);
18651+
wc_curve25519_free(x25519Key);
18652+
ret = 0; /* clear error to enable key-type detect cascade */
1863918653
}
18654+
WC_FREE_VAR_EX(x25519Key, heap, DYNAMIC_TYPE_CURVE25519);
1864018655
}
1864118656
#endif
1864218657
#ifdef HAVE_CURVE448
1864318658
if (keyAlgo == WC_PK_TYPE_NONE) {
1864418659
word32 idx = 0;
18645-
curve448_key x448Key;
18646-
ret = wc_curve448_init(&x448Key);
18660+
WC_DECLARE_VAR(x448Key, curve448_key, 1, heap);
18661+
WC_ALLOC_VAR_EX(x448Key, curve448_key, 1, heap,
18662+
DYNAMIC_TYPE_CURVE448, ret = MEMORY_E);
18663+
if (ret == 0)
18664+
ret = wc_curve448_init(x448Key);
1864718665
if (ret == 0) {
18648-
ret = wc_Curve448PrivateKeyDecode(keyBuf, &idx, &x448Key,
18666+
ret = wc_Curve448PrivateKeyDecode(keyBuf, &idx, x448Key,
1864918667
keySz);
1865018668
if (ret == 0)
1865118669
keyAlgo = WC_PK_TYPE_CURVE448;
18652-
wc_curve448_free(&x448Key);
18670+
wc_curve448_free(x448Key);
18671+
ret = 0; /* clear error to enable key-type detect cascade */
1865318672
}
18673+
WC_FREE_VAR_EX(x448Key, heap, DYNAMIC_TYPE_CURVE448);
1865418674
}
1865518675
#endif
1865618676

0 commit comments

Comments
 (0)