Fix: WolfCrypt Fenrir - 11 fixes

doc/dox_comments/header_files/sha.h

@@ -193,11 +193,15 @@ int wc_ShaFinalRaw(wc_Sha* sha, byte* hash);
 
     \param src Source SHA structure
     \param dst Destination SHA structure
+    (must be zeroed or previously initialized)
 
     _Example_
     \code
     wc_Sha src, dst;
-    int ret = wc_ShaCopy(&src, &dst);
+    memset(&dst, 0, sizeof(dst));
+    int ret = wc_InitSha(&src);
+    if (ret == 0)
+        ret = wc_ShaCopy(&src, &dst);
     \endcode
 
     \sa wc_InitSha

doc/dox_comments/header_files/sha256.h

@@ -366,12 +366,16 @@ int wc_Sha256_Grow(wc_Sha256* sha256, const byte* in, int inSz);
     \return negative on error
 
     \param src Source SHA256 structure
-    \param dst Destination SHA256 structure
+    \param dst Destination SHA256 structure;
+    (must be zeroed or previously initialized)
 
     _Example_
     \code
     wc_Sha256 src, dst;
-    int ret = wc_Sha256Copy(&src, &dst);
+    memset(&dst, 0, sizeof(dst));
+    int ret = wc_InitSha256(&src);
+    if (ret == 0)
+        ret = wc_Sha256Copy(&src, &dst);
     \endcode
 
     \sa wc_InitSha256
@@ -534,11 +538,15 @@ int wc_Sha224GetHash(wc_Sha224* sha224, byte* hash);
 
     \param src Source SHA224 structure
     \param dst Destination SHA224 structure
+    (must be zeroed or previously initialized)
 
     _Example_
     \code
     wc_Sha224 src, dst;
-    int ret = wc_Sha224Copy(&src, &dst);
+    memset(&dst, 0, sizeof(dst));
+    int ret = wc_InitSha224(&src);
+    if (ret == 0)
+        ret = wc_Sha224Copy(&src, &dst);
     \endcode
 
     \sa wc_InitSha224

doc/dox_comments/header_files/sha3.h

@@ -162,11 +162,13 @@ int wc_Sha3_224_GetHash(wc_Sha3* sha3, byte* hash);
 
     \param sha3 pointer to the sha3 structure to copy
     \param dst  pointer to the sha3 structure to copy into
+    (must be zeroed or previously initialized)
 
     _Example_
     \code
     wc_Sha3 sha3[1];
     wc_Sha3 sha3_dup[1];
+    memset(sha3_dup, 0, sizeof(*sha3_dup));
     if ((ret = wc_InitSha3_224(sha3, NULL, INVALID_DEVID)) != 0) {
        WOLFSSL_MSG("wc_InitSha3_224 failed");
     }
@@ -347,11 +349,13 @@ int wc_Sha3_256_GetHash(wc_Sha3* sha3, byte* hash);
 
     \param sha3 pointer to the sha3 structure to copy
     \param dst  pointer to the sha3 structure to copy into
+    (must be zeroed or previously initialized)
 
     _Example_
     \code
     wc_Sha3 sha3[1];
     wc_Sha3 sha3_dup[1];
+    memset(sha3_dup, 0, sizeof(*sha3_dup));
     if ((ret = wc_InitSha3_256(sha3, NULL, INVALID_DEVID)) != 0) {
        WOLFSSL_MSG("wc_InitSha3_256 failed");
     }
@@ -532,11 +536,13 @@ int wc_Sha3_384_GetHash(wc_Sha3* sha3, byte* hash);
 
     \param sha3 pointer to the sha3 structure to copy
     \param dst  pointer to the sha3 structure to copy into
+    (must be zeroed or previously initialized)
 
     _Example_
     \code
     wc_Sha3 sha3[1];
     wc_Sha3 sha3_dup[1];
+    memset(sha3_dup, 0, sizeof(*sha3_dup));
     if ((ret = wc_InitSha3_384(sha3, NULL, INVALID_DEVID)) != 0) {
        WOLFSSL_MSG("wc_InitSha3_384 failed");
     }
@@ -717,11 +723,13 @@ int wc_Sha3_512_GetHash(wc_Sha3* sha3, byte* hash);
 
     \param sha3 pointer to the sha3 structure to copy
     \param dst  pointer to the sha3 structure to copy into
+    (must be zeroed or previously initialized)
 
     _Example_
     \code
     wc_Sha3 sha3[1];
     wc_Sha3 sha3_dup[1];
+    memset(sha3_dup, 0, sizeof(*sha3_dup));
     if ((ret = wc_InitSha3_512(sha3, NULL, INVALID_DEVID)) != 0) {
        WOLFSSL_MSG("wc_InitSha3_512 failed");
     }
@@ -972,11 +980,13 @@ int wc_Shake128_GetHash(wc_Shake* shake, byte* hash);
 
     \param shake pointer to the shake structure to copy
     \param dst  pointer to the shake structure to copy into
+    (must be zeroed or previously initialized)
 
     _Example_
     \code
     wc_Shake shake[1];
     wc_Shake shake_dup[1];
+    memset(shake_dup, 0, sizeof(*shake_dup));
     if ((ret = wc_InitShake128(shake, NULL, INVALID_DEVID)) != 0) {
        WOLFSSL_MSG("wc_InitShake128 failed");
     }
@@ -1227,11 +1237,13 @@ int wc_Shake256_GetHash(wc_Shake* shake, byte* hash);
 
     \param shake pointer to the shake structure to copy
     \param dst  pointer to the shake structure to copy into
+    (must be zeroed or previously initialized)
 
     _Example_
     \code
     wc_Shake shake[1];
     wc_Shake shake_dup[1];
+    memset(shake_dup, 0, sizeof(*shake_dup));
     if ((ret = wc_InitShake256(shake, NULL, INVALID_DEVID)) != 0) {
        WOLFSSL_MSG("wc_InitShake256 failed");
     }

doc/dox_comments/header_files/sha512.h

@@ -273,11 +273,15 @@ int wc_Sha512GetHash(wc_Sha512* sha512, byte* hash);
 
     \param src Source SHA512 structure
     \param dst Destination SHA512 structure
+    (must be zeroed or previously initialized)
 
     _Example_
     \code
     wc_Sha512 src, dst;
-    int ret = wc_Sha512Copy(&src, &dst);
+    memset(&dst, 0, sizeof(dst));
+    int ret = wc_InitSha512(&src);
+    if (ret == 0)
+        ret = wc_Sha512Copy(&src, &dst);
     \endcode
 
     \sa wc_InitSha512
@@ -521,11 +525,15 @@ int wc_Sha512_224GetHash(wc_Sha512* sha512, byte* hash);
 
     \param src Source SHA512 structure
     \param dst Destination SHA512 structure
+    (must be zeroed or previously initialized)
 
     _Example_
     \code
     wc_Sha512 src, dst;
-    int ret = wc_Sha512_224Copy(&src, &dst);
+    memset(&dst, 0, sizeof(dst));
+    int ret = wc_InitSha512_224(&src);
+    if (ret == 0)
+        ret = wc_Sha512_224Copy(&src, &dst);
     \endcode
 
     \sa wc_InitSha512_224
@@ -747,11 +755,15 @@ int wc_Sha512_256GetHash(wc_Sha512* sha512, byte* hash);
 
     \param src Source SHA512 structure
     \param dst Destination SHA512 structure
+    (must be zeroed or previously initialized)
 
     _Example_
     \code
     wc_Sha512 src, dst;
-    int ret = wc_Sha512_256Copy(&src, &dst);
+    memset(&dst, 0, sizeof(dst));
+    int ret = wc_InitSha512_256(&src);
+    if (ret == 0)
+        ret = wc_Sha512_256Copy(&src, &dst);
     \endcode
 
     \sa wc_InitSha512_256
@@ -911,11 +923,15 @@ int wc_Sha384GetHash(wc_Sha384* sha384, byte* hash);
 
     \param src Source SHA384 structure
     \param dst Destination SHA384 structure
+    (must be zeroed or previously initialized)
 
     _Example_
     \code
     wc_Sha384 src, dst;
-    int ret = wc_Sha384Copy(&src, &dst);
+    memset(&dst, 0, sizeof(dst));
+    int ret = wc_InitSha384(&src);
+    if (ret == 0)
+        ret = wc_Sha384Copy(&src, &dst);
     \endcode
 
     \sa wc_InitSha384

tests/api/test_aes.c

@@ -93,6 +93,8 @@ static int test_wc_AesSetKey_BadArgs(Aes* aes, byte* key, word32 keyLen,
         WC_NO_ERR_TRACE(BAD_FUNC_ARG));
     ExpectIntEQ(wc_AesSetKey(aes , key , 48    , iv, AES_ENCRYPTION),
         WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_AesSetKey(aes , NULL , 48    , iv, AES_ENCRYPTION),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 
     return EXPECT_RESULT();
 }
@@ -3262,13 +3264,15 @@ int test_wc_AesGcmEncryptDecrypt_Sizes(void)
     int sz;
     int i;
     WC_DECLARE_VAR(plain, byte, GCM_LEN, NULL);
-    WC_DECLARE_VAR(cipher, byte, GCM_LEN, NULL);
+    /* enlarged size is to accommodate devcrypto build which assumes
+     * space in buffer to append auth tag */
+    WC_DECLARE_VAR(cipher, byte, GCM_LEN+WC_AES_BLOCK_SIZE, NULL);
 #ifdef HAVE_AES_DECRYPT
     WC_DECLARE_VAR(decrypted, byte, GCM_LEN, NULL);
 #endif
 
     WC_ALLOC_VAR(plain, byte, GCM_LEN, NULL);
-    WC_ALLOC_VAR(cipher, byte, GCM_LEN, NULL);
+    WC_ALLOC_VAR(cipher, byte, GCM_LEN+WC_AES_BLOCK_SIZE, NULL);
 #ifdef HAVE_AES_DECRYPT
     WC_ALLOC_VAR(decrypted, byte, GCM_LEN, NULL);
 #endif
@@ -3288,7 +3292,7 @@ int test_wc_AesGcmEncryptDecrypt_Sizes(void)
 
     ExpectIntEQ(wc_AesGcmSetKey(&aes, key32, sizeof(key32)/sizeof(byte)), 0);
     for (sz = 0; sz < WC_AES_BLOCK_SIZE; sz++) {
-        XMEMSET(cipher, 0, GCM_LEN);
+        XMEMSET(cipher, 0, GCM_LEN + WC_AES_BLOCK_SIZE);
         ExpectIntEQ(wc_AesGcmEncrypt(&aes, cipher, plain, sz, iv, ivLen, tag,
             sizeof(tag), NULL, 0), 0);
         ExpectBufEQ(cipher, expected, sz);
@@ -3304,7 +3308,7 @@ int test_wc_AesGcmEncryptDecrypt_Sizes(void)
 
     i = 0;
     for (sz = WC_AES_BLOCK_SIZE; sz <= GCM_LEN; sz *= 2) {
-        XMEMSET(cipher, 0, GCM_LEN);
+        XMEMSET(cipher, 0, GCM_LEN + WC_AES_BLOCK_SIZE);
         ExpectIntEQ(wc_AesGcmEncrypt(&aes, cipher, plain, sz, iv, ivLen, tag,
             sizeof(tag), NULL, 0), 0);
         ExpectBufEQ(tag, expTagLong[i], WC_AES_BLOCK_SIZE);
@@ -3994,7 +3998,9 @@ int test_wc_AesGcmNonStdNonce(void)
  * and cannot exercise the GHASH-based counter derivation. */
 #if !defined(NO_AES) && defined(HAVE_AESGCM) && \
     !defined(HAVE_FIPS) && \
-    !defined(WOLFSSL_AFALG) && !defined(WOLFSSL_KCAPI)
+    !defined(WOLFSSL_AFALG) && !defined(WOLFSSL_KCAPI) && \
+    !defined(WOLFSSL_DEVCRYPTO_AES)
+    /* DEVCRYPTO does not support Non std Nonce */
 
     /* ------------------------------------------------------------------
      * Section 1: 1-byte IV, AES-128

wolfcrypt/src/aes.c

@@ -5971,7 +5971,13 @@ static void AesSetKey_C(Aes* aes, const byte* key, word32 keySz, int dir)
 
     #if defined(WOLFSSL_DEVCRYPTO) && \
         (defined(WOLFSSL_DEVCRYPTO_AES) || defined(WOLFSSL_DEVCRYPTO_CBC))
-        aes->ctx.cfd = -1;
+        /* Release any session already held. The session was created with the
+         * previous key, so re-keying must tear it down rather than just mark
+         * the context uninitialized, which would orphan the descriptor and
+         * leave the stale key in use. */
+        wc_DevCryptoFree(&aes->ctx);
+        aes->ctx.inited = 0;
+        aes->ctx.cfd = -1; /* not set when no session was open */
     #endif
     #ifdef WOLFSSL_IMX6_CAAM_BLOB
     #ifdef WOLFSSL_CHECK_MEM_ZERO
@@ -15786,7 +15792,8 @@ int wc_AesInit(Aes* aes, void* heap, int devId)
 #endif
 #if defined(WOLFSSL_DEVCRYPTO) && \
    (defined(WOLFSSL_DEVCRYPTO_AES) || defined(WOLFSSL_DEVCRYPTO_CBC))
-    aes->ctx.cfd = -1;
+    aes->ctx.cfd    = -1;
+    aes->ctx.inited = 0;
 #endif
 #if defined(WOLFSSL_IMXRT_DCP)
     DCPAesInit(aes);

wolfcrypt/src/des3.c

@@ -1565,16 +1565,23 @@
             for (i = 0; i < 16; i++) {            /* key chunk for each iteration */
                 XMEMSET(ks, 0, 8);                /* Clear key schedule */
 
-                for (j = 0; j < 56; j++)          /* rotate pc1 the right amount  */
-                    pcr[j] =
-                          pc1m[(l = j + totrot[i]) < (j < 28 ? 28 : 56) ? l : l-28];
-
                 /* rotate left and right halves independently */
-                for (j = 0; j < 48; j++) {        /* select bits individually     */
-                    if (pcr[pc2[j] - 1]) {        /* check bit that goes to ks[j] */
-                        l= j % 6;                 /* mask it in if it's there     */
-                        ks[j/6] |= (byte)(bytebit[l] >> 2);
-                    }
+                for (j = 0; j < 28; j++) {   /* rotate pc1 the right amount */
+                    l = (j + totrot[i]) % 28;
+                    pcr[j]      = pc1m[l];
+                    pcr[j + 28] = pc1m[l + 28];
+                }
+
+                for (j = 0; j < 48; j++) { /* select bits individually */
+                    byte bit;
+                    byte mask;
+                    bit =
+                        (byte)(pcr[pc2[j] - 1]); /* all pcr values are either 0
+                                                    or 1 */
+                    mask = (byte)(0 - bit);   /* mask is either 0xFF or 0x00 */
+                    /* only set to bytebit value if bit == 1 */
+                    ks[j/6] |=
+                        (byte)((bytebit[j % 6] >> 2) & mask);
                 }
 
                 /* Now convert to odd/even interleaved form for use in F */

wolfcrypt/src/dsa.c

@@ -1151,6 +1151,13 @@ int wc_DsaVerify_ex(const byte* digest, word32 digestSz, const byte* sig,
     if (digest == NULL || sig == NULL || key == NULL || answer == NULL)
         return BAD_FUNC_ARG;
 
+    /* assign default value so verification is always failed on error */
+    *answer = 0;
+
+    /* Note the min allowed digestSz here is WC_MIN_DIGEST_SIZE_FOR_VERIFY, not
+     * WC_MIN_DIGEST_SIZE, to allow verify-only legacy DSA operations, as
+     * expressly allowed under FIPS 186-5, FIPS 140-3, and SP 800-131A.
+     */
     if ((digestSz > WC_MAX_DIGEST_SIZE) ||
         (digestSz < WC_MIN_DIGEST_SIZE_FOR_VERIFY))
     {

wolfcrypt/src/hmac.c

@@ -1536,7 +1536,8 @@ int wc_HmacInit(Hmac* hmac, void* heap, int devId)
     hmac->devCtx = NULL;
 #endif
 #if defined(WOLFSSL_DEVCRYPTO_HMAC)
-    hmac->ctx.cfd = -1;
+    hmac->ctx.inited = 0;
+    hmac->ctx.cfd    = -1;
 #endif
 
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_HMAC)

wolfcrypt/src/port/Espressif/esp_crt_bundle/esp_crt_bundle.c

@@ -983,14 +983,12 @@ static CB_INLINE int wolfssl_ssl_conf_verify_cb_no_signer(int preverify,
     /* Clean up and exit */
     if ((_crt_found == 0) && (bundle_cert != NULL)) {
         ESP_LOGW(TAG, "Cert not found, free bundle_cert");
+        /* this_subject and this_issuer are a part of bundle_cert and will be
+         * freed here */
         wolfSSL_X509_free(bundle_cert);
         bundle_cert = NULL;
-        /* this_subject and this_issuer are pointers into cert used.
-         * Don't free if the cert was found. */
-        wolfSSL_X509_NAME_free(this_subject);
-        this_subject = NULL;
-        wolfSSL_X509_NAME_free(this_issuer);
         this_issuer = NULL;
+        this_subject = NULL;
     }
 
     /* We don't clean up the store_cert and x509 as we are in a callback,

wolfcrypt/src/port/Renesas/renesas_fspsm_aes.c

@@ -411,9 +411,12 @@ int  wc_fspsm_AesGcmEncrypt(struct Aes* aes, byte* out,
             key_server_aes = (FSPSM_AES_PWKEY)XMALLOC(sizeof(FSPSM_AES_WKEY),
                                             aes->heap, DYNAMIC_TYPE_AES);
             if (key_client_aes == NULL || key_server_aes == NULL) {
-                XFREE(plainBuf,  aes->heap, DYNAMIC_TYPE_AES);
-                XFREE(cipherBuf, aes->heap, DYNAMIC_TYPE_AES);
-                XFREE(aTagBuf,   aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(key_client_aes,  aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(key_server_aes,  aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(plainBuf,       aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(cipherBuf,      aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(aTagBuf,        aes->heap, DYNAMIC_TYPE_AES);
+                wc_fspsm_hw_unlock();
                 return MEMORY_E;
             }
 
@@ -638,9 +641,12 @@ int  wc_fspsm_AesGcmDecrypt(struct Aes* aes, byte* out,
             key_server_aes = (FSPSM_AES_PWKEY)XMALLOC(sizeof(FSPSM_AES_WKEY),
                                             aes->heap, DYNAMIC_TYPE_AES);
             if (key_client_aes == NULL || key_server_aes == NULL) {
-                XFREE(plainBuf,  aes->heap, DYNAMIC_TYPE_AES);
-                XFREE(cipherBuf, aes->heap, DYNAMIC_TYPE_AES);
-                XFREE(aTagBuf,   aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(key_client_aes,  aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(key_server_aes,  aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(plainBuf,        aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(cipherBuf,       aes->heap, DYNAMIC_TYPE_AES);
+                XFREE(aTagBuf,         aes->heap, DYNAMIC_TYPE_AES);
+                wc_fspsm_hw_unlock();
                 return MEMORY_E;
             }