From 717e52d02b12aac21c595ef05dadc1db987b20c3 Mon Sep 17 00:00:00 2001 From: Emma Stensland Date: Thu, 2 Jul 2026 09:45:05 -0600 Subject: [PATCH] F-1305 F-1306 F-1714 F-2111 F-2905 F-2906 F-2909 F-3897 F-4125 F-4608 F-6288: fix NULL-deref, fd-leak, unaligned-access, and buffer-overflow bugs across CAN, PKCS7, embedded, and PEM-printing examples --- RPi-Pico/src/tlsClient_main.c | 3 ++- embedded/sockets.h | 9 +++++++-- embedded/tls-info.h | 17 +++++++++++++---- pkcs7/signedData-EncryptedFirmwareCB.c | 7 ++++++- pq/stateful_hash_sig/xmss_example.c | 6 ++++-- .../tcpEcho_Server_TivaTM4C1294NCPDT/tcpEcho.c | 2 +- tls/memory-tls.c | 17 +++++++++++++++++ 7 files changed, 50 insertions(+), 11 deletions(-) diff --git a/RPi-Pico/src/tlsClient_main.c b/RPi-Pico/src/tlsClient_main.c index dfa7eb42..2ca9c01a 100644 --- a/RPi-Pico/src/tlsClient_main.c +++ b/RPi-Pico/src/tlsClient_main.c @@ -158,11 +158,12 @@ void tlsClient_test(void *arg) goto exit; } - ret = wolfSSL_read(ssl, buffer, BUFF_SIZE); + ret = wolfSSL_read(ssl, buffer, BUFF_SIZE - 1); if (ret < 0) { printf("Failed to read data. err=%d\n", ret); goto exit; } + buffer[ret] = '\0'; printf("Message: %s\n", buffer); wolfSSL_free(ssl); diff --git a/embedded/sockets.h b/embedded/sockets.h index ddced04d..090110a9 100644 --- a/embedded/sockets.h +++ b/embedded/sockets.h @@ -35,8 +35,13 @@ typedef int socklen_t ; static unsigned long inet_addr(const char *cp) { - unsigned int a[4] ; unsigned long ret ; - sscanf(cp, "%d.%d.%d.%d", &a[0], &a[1], &a[2], &a[3]) ; + unsigned int a[4] = {0, 0, 0, 0} ; unsigned long ret ; int i ; + if (sscanf(cp, "%u.%u.%u.%u", &a[0], &a[1], &a[2], &a[3]) != 4) + return 0xFFFFFFFFUL ; /* INADDR_NONE */ + for (i = 0; i < 4; i++) { + if (a[i] > 255) + return 0xFFFFFFFFUL ; /* INADDR_NONE */ + } ret = ((a[3]<<24) + (a[2]<<16) + (a[1]<<8) + a[0]) ; return(ret) ; } diff --git a/embedded/tls-info.h b/embedded/tls-info.h index 55929994..a82c8fbc 100644 --- a/embedded/tls-info.h +++ b/embedded/tls-info.h @@ -145,14 +145,23 @@ static WC_INLINE void ShowX509Chain(WOLFSSL_X509_CHAIN* chain, int count, const char* hdr) { int i; - int length; + int ret; + int length = 0; unsigned char buffer[3072]; WOLFSSL_X509* chainX509; for (i = 0; i < count; i++) { - wolfSSL_get_chain_cert_pem(chain, i, buffer, sizeof(buffer), &length); - buffer[length] = 0; - printf("\n%s: %d has length %d data = \n%s\n", hdr, i, length, buffer); + ret = wolfSSL_get_chain_cert_pem(chain, i, buffer, sizeof(buffer), + &length); + if (ret == WOLFSSL_SUCCESS && length >= 0 && + length < (int)sizeof(buffer)) { + buffer[length] = 0; + printf("\n%s: %d has length %d data = \n%s\n", hdr, i, length, + buffer); + } + else { + printf("\n%s: %d failed to get chain cert pem\n", hdr, i); + } chainX509 = wolfSSL_get_chain_X509(chain, i); if (chainX509) diff --git a/pkcs7/signedData-EncryptedFirmwareCB.c b/pkcs7/signedData-EncryptedFirmwareCB.c index b0d90694..caf267be 100644 --- a/pkcs7/signedData-EncryptedFirmwareCB.c +++ b/pkcs7/signedData-EncryptedFirmwareCB.c @@ -192,7 +192,7 @@ static int myDecryptionFunc(PKCS7* pkcs7, int encryptOID, byte* iv, int ivSz, printf("%02X", keyIdRaw[i]); printf("\n"); } - keyId = *(int*)(keyIdRaw + 2); + XMEMCPY(&keyId, keyIdRaw + 2, sizeof(keyId)); printf("\t\tStripping off OCTET TAG and length the keyId = %d\n", keyId); } @@ -473,6 +473,11 @@ static int verifyBundle(byte* derBuf, word32 derSz) int decodedSz = 2048; pkcs7 = wc_PKCS7_New(NULL, 0); + if (pkcs7 == NULL) { + printf("\tError allocating PKCS7 structure\n"); + ret = MEMORY_E; + goto exit; + } /* Test verify */ ret = wc_PKCS7_Init(pkcs7, NULL, INVALID_DEVID); diff --git a/pq/stateful_hash_sig/xmss_example.c b/pq/stateful_hash_sig/xmss_example.c index 70e9243f..28ba647e 100644 --- a/pq/stateful_hash_sig/xmss_example.c +++ b/pq/stateful_hash_sig/xmss_example.c @@ -20,6 +20,8 @@ */ #include #include +#include +#include #include #include @@ -116,8 +118,8 @@ write_key_file(const byte * priv, /* Create the file if it didn't exist. */ file = fopen(filename, "w+"); if (!file) { - fprintf(stderr, "error: fopen(%s, \"w+\") failed: %d\n", filename, - ferror(file)); + fprintf(stderr, "error: fopen(%s, \"w+\") failed: %s\n", filename, + strerror(errno)); return WC_XMSS_RC_WRITE_FAIL; } } diff --git a/tirtos_ccs_examples/tcpEcho_Server_TivaTM4C1294NCPDT/tcpEcho.c b/tirtos_ccs_examples/tcpEcho_Server_TivaTM4C1294NCPDT/tcpEcho.c index 5e5e2859..75d551b9 100644 --- a/tirtos_ccs_examples/tcpEcho_Server_TivaTM4C1294NCPDT/tcpEcho.c +++ b/tirtos_ccs_examples/tcpEcho_Server_TivaTM4C1294NCPDT/tcpEcho.c @@ -211,7 +211,7 @@ Void tcpHandler(UArg arg0, UArg arg1) /* Wait for incoming request */ if ((clientfd = accept(lSocket, (struct sockaddr*)&client_addr, &addrlen)) == -1) { - System_printf("tcpHandler: Accept failed %d\n"); + System_printf("tcpHandler: Accept failed %d\n", fdError()); exitApp(ctx); } diff --git a/tls/memory-tls.c b/tls/memory-tls.c index 4ac7e1c4..cbe2baff 100644 --- a/tls/memory-tls.c +++ b/tls/memory-tls.c @@ -52,11 +52,22 @@ pthread_mutex_t client_mutex = PTHREAD_MUTEX_INITIALIZER; pthread_cond_t client_cond = PTHREAD_COND_INITIALIZER; +/* Manual test for the buffer-full guard below: shrink to_server/to_client + * to a small size (e.g. 1024) and have client_thread() call wolfSSL_write() + * with a message larger than that buffer; ServerSend/ClientSend should + * return WOLFSSL_CBIO_ERR_GENERAL instead of overflowing the array. */ + /* server send callback */ int ServerSend(WOLFSSL* ssl, char* buf, int sz, void* ctx) { pthread_mutex_lock(&client_mutex); + if (client_write_idx + sz > (int)sizeof(to_client)) { + pthread_cond_signal(&client_cond); + pthread_mutex_unlock(&client_mutex); + return WOLFSSL_CBIO_ERR_GENERAL; + } + memcpy(&to_client[client_write_idx], buf, sz); client_write_idx += sz; client_bytes += sz; @@ -95,6 +106,12 @@ int ClientSend(WOLFSSL* ssl, char* buf, int sz, void* ctx) { pthread_mutex_lock(&server_mutex); + if (server_write_idx + sz > (int)sizeof(to_server)) { + pthread_cond_signal(&server_cond); + pthread_mutex_unlock(&server_mutex); + return WOLFSSL_CBIO_ERR_GENERAL; + } + memcpy(&to_server[server_write_idx], buf, sz); server_write_idx += sz; server_bytes += sz;