WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity

F-7394: sign: free RNG on RSA-PSS unsupported-hash error 

The error path returned before the common wc_FreeRng(), leaving
DRBG state on the stack. Route it through the shared cleanup and
guard the sign call so hash_type/mgf are only used when set.
pull/892/head
Daniele Lacamera 2026-09-15 15:14:38 +02:00
parent e38e844381
commit b1884b03d7
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
tools/keytools/sign.c
View File

@ -1218,13 +1218,15 @@ static int sign_digest(int sign, int hash_algo,
mgf = WC_MGF1SHA384;
} else {
fprintf(stderr, "RSA-PSS requires SHA-256 or SHA-384\n");
return -1;
ret = -1;
}
ret = wc_RsaPSS_Sign(digest, digest_sz, signature, *signature_sz,
hash_type, mgf, &k->rsa, &rng);
if (ret > 0) {
*signature_sz = ret;
ret = 0;
if (ret == 0) {
ret = wc_RsaPSS_Sign(digest, digest_sz, signature, *signature_sz,
hash_type, mgf, &k->rsa, &rng);
if (ret > 0) {
*signature_sz = ret;
ret = 0;
}
}
}
else