mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-03-14 01:26:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add buffer copying to psa_verify_hash_start()

Browse Source 
Protect input buffers to psa_verify_hash_start(), namely the hash and
signature parameters.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
This commit is contained in:
David Horstmann 2024-03-11 13:41:05 +00:00
parent 4a523a608e
commit 0fea6a52b4
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
library/psa_crypto.c
View File

@ -3717,13 +3717,16 @@ static psa_status_t psa_verify_hash_abort_internal(
psa_status_t psa_verify_hash_start(
psa_verify_hash_interruptible_operation_t *operation,
mbedtls_svc_key_id_t key, psa_algorithm_t alg,
const uint8_t *hash, size_t hash_length,
const uint8_t *signature, size_t signature_length)
const uint8_t *hash_external, size_t hash_length,
const uint8_t *signature_external, size_t signature_length)
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
psa_key_slot_t *slot;
LOCAL_INPUT_DECLARE(hash_external, hash);
LOCAL_INPUT_DECLARE(signature_external, signature);
/* Check that start has not been previously called, or operation has not
* previously errored. */
if (operation->id != 0 || operation->error_occurred) {
@ -3745,6 +3748,9 @@ psa_status_t psa_verify_hash_start(
return status;
}
LOCAL_INPUT_ALLOC(hash_external, hash_length, hash);
LOCAL_INPUT_ALLOC(signature_external, signature_length, signature);
psa_key_attributes_t attributes = {
.core = slot->attr
};
@ -3757,6 +3763,9 @@ psa_status_t psa_verify_hash_start(
slot->key.bytes,
alg, hash, hash_length,
signature, signature_length);
#if defined(MBEDTLS_PSA_COPY_CALLER_BUFFERS)
exit:
#endif
if (status != PSA_SUCCESS) {
operation->error_occurred = 1;
@ -3769,6 +3778,9 @@ psa_status_t psa_verify_hash_start(
operation->error_occurred = 1;
}
LOCAL_INPUT_FREE(hash_external, hash);
LOCAL_INPUT_FREE(signature_external, signature);
return (status == PSA_SUCCESS) ? unlock_status : status;
}