mirror of
git://git.openembedded.org/meta-openembedded
synced 2026-10-02 10:04:27 +00:00
4cbf9d8d2c
CVE-2023-5992: A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2023-5992] [https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992] Upstream patches: [https://github.com/OpenSC/OpenSC/pull/2948] [https://github.com/OpenSC/OpenSC/pull/3016] Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
124 lines
5.3 KiB
Diff
124 lines
5.3 KiB
Diff
From e5f77a60bf22d76f695e360cc5c13c5c9ea8ba0c Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Veronika=20Hanul=C3=ADkov=C3=A1?= <vhanulik@redhat.com>
|
|
Date: Mon, 5 Feb 2024 11:30:11 +0100
|
|
Subject: [PATCH 09/10] unittests: Do not use uninitialized memory
|
|
|
|
Thanks Coverity CID 414676, 414677, 414678,
|
|
414679, 414680, 414681, 414682, 414683, 414684,
|
|
414685, 414686
|
|
|
|
CVE: CVE-2023-5992
|
|
Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/pull/3016]
|
|
|
|
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
|
|
---
|
|
src/tests/unittests/strip_pkcs1_2_padding.c | 22 ++++++++++-----------
|
|
1 file changed, 11 insertions(+), 11 deletions(-)
|
|
|
|
diff --git a/src/tests/unittests/strip_pkcs1_2_padding.c b/src/tests/unittests/strip_pkcs1_2_padding.c
|
|
index f9561b936..990e94a38 100644
|
|
--- a/src/tests/unittests/strip_pkcs1_2_padding.c
|
|
+++ b/src/tests/unittests/strip_pkcs1_2_padding.c
|
|
@@ -14,7 +14,7 @@ torture_long_output_buffer(void **state)
|
|
0x00,
|
|
'm', 's', 'g'};
|
|
unsigned int out_len = 3;
|
|
- unsigned char *out = malloc(out_len * sizeof(unsigned char));
|
|
+ unsigned char *out = calloc(out_len, sizeof(unsigned char));
|
|
unsigned char result_msg[] = {'m', 's', 'g'};
|
|
int r = sc_pkcs1_strip_02_padding_constant_time(NULL, n, in, in_len, out, &out_len);
|
|
assert_int_equal(r, 3);
|
|
@@ -32,7 +32,7 @@ torture_short_output_buffer(void **state)
|
|
0x00,
|
|
'm', 's', 'g'};
|
|
unsigned int out_len = 1;
|
|
- unsigned char *out = malloc(out_len * sizeof(unsigned char));
|
|
+ unsigned char *out = calloc(out_len, sizeof(unsigned char));
|
|
int r = sc_pkcs1_strip_02_padding_constant_time(NULL, n, in, in_len, out, &out_len);
|
|
assert_int_equal(r, SC_ERROR_WRONG_PADDING);
|
|
free(out);
|
|
@@ -48,7 +48,7 @@ torture_short_message_correct_padding(void **state)
|
|
0x00,
|
|
'm', 's', 'g'};
|
|
unsigned int out_len = 3;
|
|
- unsigned char *out = malloc(out_len * sizeof(unsigned char));
|
|
+ unsigned char *out = calloc(out_len, sizeof(unsigned char));
|
|
unsigned char result_msg[] = {'m', 's', 'g'};
|
|
int r = sc_pkcs1_strip_02_padding_constant_time(NULL, n, in, in_len, out, &out_len);
|
|
assert_int_equal(r, 3);
|
|
@@ -66,7 +66,7 @@ torture_missing_first_zero(void **state)
|
|
0x00,
|
|
'm', 's', 'g'};
|
|
unsigned int out_len = 10;
|
|
- unsigned char *out = malloc(out_len * sizeof(unsigned char));
|
|
+ unsigned char *out = calloc(out_len, sizeof(unsigned char));
|
|
int r = sc_pkcs1_strip_02_padding_constant_time(NULL, n, in, in_len, out, &out_len);
|
|
assert_int_equal(r, SC_ERROR_WRONG_PADDING);
|
|
free(out);
|
|
@@ -82,7 +82,7 @@ torture_missing_two(void **state)
|
|
0x00,
|
|
'm', 's', 'g'};
|
|
unsigned int out_len = 10;
|
|
- unsigned char *out = malloc(out_len * sizeof(unsigned char));
|
|
+ unsigned char *out = calloc(out_len, sizeof(unsigned char));
|
|
int r = sc_pkcs1_strip_02_padding_constant_time(NULL, n, in, in_len, out, &out_len);
|
|
assert_int_equal(r, SC_ERROR_WRONG_PADDING);
|
|
free(out);
|
|
@@ -98,7 +98,7 @@ torture_short_padding(void **state)
|
|
0x00,
|
|
'm', 's', 'g'};
|
|
unsigned int out_len = 10;
|
|
- unsigned char *out = malloc(out_len * sizeof(unsigned char));
|
|
+ unsigned char *out = calloc(out_len, sizeof(unsigned char));
|
|
int r = sc_pkcs1_strip_02_padding_constant_time(NULL, n, in, in_len, out, &out_len);
|
|
assert_int_equal(r, SC_ERROR_WRONG_PADDING);
|
|
free(out);
|
|
@@ -113,7 +113,7 @@ torture_missing_second_zero(void **state)
|
|
0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
|
|
'm', 's', 'g'};
|
|
unsigned int out_len = 10;
|
|
- unsigned char *out = malloc(out_len * sizeof(unsigned char));
|
|
+ unsigned char *out = calloc(out_len, sizeof(unsigned char));
|
|
int r = sc_pkcs1_strip_02_padding_constant_time(NULL, n, in, in_len, out, &out_len);
|
|
assert_int_equal(r, SC_ERROR_WRONG_PADDING);
|
|
free(out);
|
|
@@ -128,7 +128,7 @@ torture_missing_message(void **state)
|
|
0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
|
|
0x00};
|
|
unsigned int out_len = 11;
|
|
- unsigned char *out = malloc(out_len * sizeof(unsigned char));
|
|
+ unsigned char *out = calloc(out_len, sizeof(unsigned char));
|
|
int r = sc_pkcs1_strip_02_padding_constant_time(NULL, n, in, in_len, out, &out_len);
|
|
assert_int_equal(r, SC_ERROR_WRONG_PADDING);
|
|
free(out);
|
|
@@ -144,7 +144,7 @@ torture_one_byte_message(void **state)
|
|
0x00,
|
|
'm'};
|
|
unsigned int out_len = 1;
|
|
- unsigned char *out = malloc(out_len * sizeof(unsigned char));
|
|
+ unsigned char *out = calloc(out_len, sizeof(unsigned char));
|
|
unsigned char result_msg[] = {'m'};
|
|
int r = sc_pkcs1_strip_02_padding_constant_time(NULL, n, in, in_len, out, &out_len);
|
|
assert_int_equal(r, 1);
|
|
@@ -162,7 +162,7 @@ torture_longer_padding(void **state)
|
|
0x00,
|
|
0x9d, 0x98, 0x3d, 0xca, 0xa9, 0xa7, 0x11, 0x0a};
|
|
unsigned int out_len = 8;
|
|
- unsigned char *out = malloc(out_len * sizeof(unsigned char));
|
|
+ unsigned char *out = calloc(out_len, sizeof(unsigned char));
|
|
unsigned char result_msg[] = {0x9d, 0x98, 0x3d, 0xca, 0xa9, 0xa7, 0x11, 0x0a};
|
|
int r = sc_pkcs1_strip_02_padding_constant_time(NULL, n, in, in_len, out, &out_len);
|
|
assert_int_equal(r, 8);
|
|
@@ -179,7 +179,7 @@ torture_empty_message(void **state)
|
|
0x0e, 0x38, 0x97, 0x18, 0x16, 0x57, 0x9e, 0x30, 0xb6, 0xa5, 0x78, 0x13, 0x20, 0xca, 0x11,
|
|
0x00};
|
|
unsigned int out_len = 8;
|
|
- unsigned char *out = malloc(out_len * sizeof(unsigned char));
|
|
+ unsigned char *out = calloc(out_len, sizeof(unsigned char));
|
|
int r = sc_pkcs1_strip_02_padding_constant_time(NULL, n, in, in_len, out, &out_len);
|
|
assert_int_equal(r, 0);
|
|
free(out);
|
|
--
|
|
2.50.0
|
|
|