F-1305 F-1306 F-1714 F-2111 F-2905 F-2906 F-2909 F-3897 F-4125 F-4608 F-6288: fix NULL-deref, fd-leak, unaligned-access, and buffer-overflow bugs across CAN, PKCS7, embedded, and PEM-printing examples

RPi-Pico/src/tlsClient_main.c

@@ -158,11 +158,12 @@ void tlsClient_test(void *arg)
             goto exit;
         }
 
-        ret = wolfSSL_read(ssl, buffer, BUFF_SIZE);
+        ret = wolfSSL_read(ssl, buffer, BUFF_SIZE - 1);
         if (ret < 0) {
             printf("Failed to read data. err=%d\n", ret);
             goto exit;
         }
+        buffer[ret] = '\0';
         printf("Message: %s\n", buffer);
 
         wolfSSL_free(ssl);

embedded/sockets.h

@@ -35,8 +35,13 @@
         typedef int socklen_t ;
         static unsigned long inet_addr(const char *cp)
     {
-        unsigned int a[4] ; unsigned long ret ;
-        sscanf(cp, "%d.%d.%d.%d", &a[0], &a[1], &a[2], &a[3]) ;
+        unsigned int a[4] = {0, 0, 0, 0} ; unsigned long ret ; int i ;
+        if (sscanf(cp, "%u.%u.%u.%u", &a[0], &a[1], &a[2], &a[3]) != 4)
+            return 0xFFFFFFFFUL ; /* INADDR_NONE */
+        for (i = 0; i < 4; i++) {
+            if (a[i] > 255)
+                return 0xFFFFFFFFUL ; /* INADDR_NONE */
+        }
         ret = ((a[3]<<24) + (a[2]<<16) + (a[1]<<8) + a[0]) ;
         return(ret) ;
     }

embedded/tls-info.h

@@ -145,14 +145,23 @@ static WC_INLINE void ShowX509Chain(WOLFSSL_X509_CHAIN* chain, int count,
     const char* hdr)
 {
     int i;
-    int length;
+    int ret;
+    int length = 0;
     unsigned char buffer[3072];
     WOLFSSL_X509* chainX509;
 
     for (i = 0; i < count; i++) {
-        wolfSSL_get_chain_cert_pem(chain, i, buffer, sizeof(buffer), &length);
-        buffer[length] = 0;
-        printf("\n%s: %d has length %d data = \n%s\n", hdr, i, length, buffer);
+        ret = wolfSSL_get_chain_cert_pem(chain, i, buffer, sizeof(buffer),
+                &length);
+        if (ret == WOLFSSL_SUCCESS && length >= 0 &&
+                length < (int)sizeof(buffer)) {
+            buffer[length] = 0;
+            printf("\n%s: %d has length %d data = \n%s\n", hdr, i, length,
+                    buffer);
+        }
+        else {
+            printf("\n%s: %d failed to get chain cert pem\n", hdr, i);
+        }
 
         chainX509 = wolfSSL_get_chain_X509(chain, i);
         if (chainX509)

pkcs7/signedData-EncryptedFirmwareCB.c

@@ -192,7 +192,7 @@ static int myDecryptionFunc(PKCS7* pkcs7, int encryptOID, byte* iv, int ivSz,
                 printf("%02X", keyIdRaw[i]);
             printf("\n");
         }
-        keyId = *(int*)(keyIdRaw + 2);
+        XMEMCPY(&keyId, keyIdRaw + 2, sizeof(keyId));
         printf("\t\tStripping off OCTET TAG and length the keyId = %d\n", keyId);
     }
 
@@ -473,6 +473,11 @@ static int verifyBundle(byte* derBuf, word32 derSz)
     int  decodedSz = 2048;
 
     pkcs7 = wc_PKCS7_New(NULL, 0);
+    if (pkcs7 == NULL) {
+        printf("\tError allocating PKCS7 structure\n");
+        ret = MEMORY_E;
+        goto exit;
+    }
 
     /* Test verify */
     ret = wc_PKCS7_Init(pkcs7, NULL, INVALID_DEVID);

pq/stateful_hash_sig/xmss_example.c

@@ -20,6 +20,8 @@
  */
 #include <stdio.h>
 #include <stdlib.h>
+#include <errno.h>
+#include <string.h>
 
 #include <wolfssl/options.h>
 #include <wolfssl/wolfcrypt/error-crypt.h>
@@ -116,8 +118,8 @@ write_key_file(const byte * priv,
         /* Create the file if it didn't exist. */
         file = fopen(filename, "w+");
         if (!file) {
-            fprintf(stderr, "error: fopen(%s, \"w+\") failed: %d\n", filename,
-                    ferror(file));
+            fprintf(stderr, "error: fopen(%s, \"w+\") failed: %s\n", filename,
+                    strerror(errno));
             return WC_XMSS_RC_WRITE_FAIL;
         }
     }

tirtos_ccs_examples/tcpEcho_Server_TivaTM4C1294NCPDT/tcpEcho.c

@@ -211,7 +211,7 @@ Void tcpHandler(UArg arg0, UArg arg1)
         /* Wait for incoming request */
         if ((clientfd = accept(lSocket, (struct sockaddr*)&client_addr,
             &addrlen)) == -1) {
-            System_printf("tcpHandler: Accept failed %d\n");
+            System_printf("tcpHandler: Accept failed %d\n", fdError());
             exitApp(ctx);
         }
 

tls/memory-tls.c

@@ -52,11 +52,22 @@ pthread_mutex_t client_mutex = PTHREAD_MUTEX_INITIALIZER;
 pthread_cond_t  client_cond  = PTHREAD_COND_INITIALIZER;
 
 
+/* Manual test for the buffer-full guard below: shrink to_server/to_client
+ * to a small size (e.g. 1024) and have client_thread() call wolfSSL_write()
+ * with a message larger than that buffer; ServerSend/ClientSend should
+ * return WOLFSSL_CBIO_ERR_GENERAL instead of overflowing the array. */
+
 /* server send callback */
 int ServerSend(WOLFSSL* ssl, char* buf, int sz, void* ctx)
 {
     pthread_mutex_lock(&client_mutex);
 
+    if (client_write_idx + sz > (int)sizeof(to_client)) {
+        pthread_cond_signal(&client_cond);
+        pthread_mutex_unlock(&client_mutex);
+        return WOLFSSL_CBIO_ERR_GENERAL;
+    }
+
     memcpy(&to_client[client_write_idx], buf, sz);
     client_write_idx += sz;
     client_bytes += sz;
@@ -95,6 +106,12 @@ int ClientSend(WOLFSSL* ssl, char* buf, int sz, void* ctx)
 {
     pthread_mutex_lock(&server_mutex);
 
+    if (server_write_idx + sz > (int)sizeof(to_server)) {
+        pthread_cond_signal(&server_cond);
+        pthread_mutex_unlock(&server_mutex);
+        return WOLFSSL_CBIO_ERR_GENERAL;
+    }
+
     memcpy(&to_server[server_write_idx], buf, sz);
     server_write_idx += sz;
     server_bytes += sz;