Skip to content

Fix issues found in static code analysis #212

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
LinuxJedi wants to merge 14 commits into
base: master
Choose a base branch
from
Open

Fix issues found in static code analysis #212

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
08a5563
Validate default interface filters F-8659
LinuxJedi Aug 20, 2026
dd48205
Stop advertising unsupported SSL3 derive F-8651
LinuxJedi Aug 20, 2026
70238c9
Restrict private objects to user sessions F-8650
LinuxJedi Aug 20, 2026
ae2f41c
Preserve key-wrap-pad decrypt retries F-8653
LinuxJedi Aug 20, 2026
ae0a54c
Retain CBC-PAD final output for retry F-8636
LinuxJedi Aug 20, 2026
5d4c63a
Enforce AES-CTR counter boundaries F-8652
LinuxJedi Aug 20, 2026
6aaaefa
Grow object find results dynamically F-8657
LinuxJedi Aug 20, 2026
e4328c9
Persist HKDF token keys F-8635
LinuxJedi Aug 20, 2026
cc786e4
Generate fresh IVs before key persistence F-8669
LinuxJedi Aug 20, 2026
3bb3255
Rollback token insertion on store failure F-8638
LinuxJedi Aug 20, 2026
c2c73a8
Preserve NSS private-object semantics F-8650
LinuxJedi Aug 20, 2026
795f542
Use portable HKDF persistence paths F-8635
LinuxJedi Aug 20, 2026
d56f566
Include Windows chmod declaration F-8638
LinuxJedi Aug 20, 2026
5918ecb
Preserve NSS TLS target discovery F-8651
LinuxJedi Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 33 additions & 5 deletions src/crypto.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -479,7 +479,14 @@ static CK_RV CheckPrivateLogin(WP11_Session* session,
return CKR_OK;
if (WP11_Slot_Has_Empty_Pin(slot))
return CKR_OK;
#ifdef WOLFPKCS11_NSS
/* NSS operates as an internal crypto module and has separate private
* object semantics. Preserve its existing any-login behavior; F-8650
* applies to the standard PKCS#11 session model. */
if (!WP11_Slot_IsLoggedIn(slot))
#else
if (!WP11_Slot_IsUserLoggedIn(slot))
#endif
return CKR_USER_NOT_LOGGED_IN;
return CKR_OK;
}
Expand Down Expand Up @@ -2147,7 +2154,7 @@ CK_RV C_SetAttributeValue(CK_SESSION_HANDLE hSession,

/**
* Initialize the finding of an object associated with the session.
* All matching objects are found, up to a limit, by this call.
* All matching objects are found by this call.
*
* @param hSession [in] Handle of session.
* @param pTemplate [in] Template of attributes match against object.
Expand All @@ -2167,6 +2174,7 @@ CK_RV C_FindObjectsInit(CK_SESSION_HANDLE hSession,
CK_RV rv;
WP11_Session* session;
CK_ATTRIBUTE* attr;
int ret;
int onToken = 1;

WOLFPKCS11_ENTER("C_FindObjectsInit");
Expand All @@ -2192,28 +2200,37 @@ CK_RV C_FindObjectsInit(CK_SESSION_HANDLE hSession,
return rv;
}

if (WP11_Session_FindInit(session) != 0) {
rv = CKR_OPERATION_ACTIVE;
ret = WP11_Session_FindInit(session);
if (ret != 0) {
rv = ret == MEMORY_E ? CKR_HOST_MEMORY : CKR_OPERATION_ACTIVE;
WOLFPKCS11_LEAVE("C_FindObjectsInit", rv);
return rv;
}

FindAttributeType(pTemplate, ulCount, CKA_TOKEN, &attr);
if (attr != NULL) {
if (attr->pValue == NULL) {
WP11_Session_FindFinal(session);
rv = CKR_ATTRIBUTE_VALUE_INVALID;
WOLFPKCS11_LEAVE("C_FindObjectsInit", rv);
return rv;
}
if (attr->ulValueLen != sizeof(CK_BBOOL)) {
WP11_Session_FindFinal(session);
rv = CKR_ATTRIBUTE_VALUE_INVALID;
WOLFPKCS11_LEAVE("C_FindObjectsInit", rv);
return rv;
}
onToken = *(CK_BBOOL*)attr->pValue;
}

WP11_Session_Find(session, onToken, pTemplate, ulCount);
ret = WP11_Session_Find(session, onToken, pTemplate, ulCount);
if (ret != 0) {
WP11_Session_FindFinal(session);
rv = ret == MEMORY_E ? CKR_HOST_MEMORY : CKR_FUNCTION_FAILED;
WOLFPKCS11_LEAVE("C_FindObjectsInit", rv);
return rv;
}

rv = CKR_OK;
WOLFPKCS11_LEAVE("C_FindObjectsInit", rv);
Expand Down Expand Up @@ -2829,6 +2846,8 @@ CK_RV C_Encrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pData,
encDataLen = (word32)*pulEncryptedDataLen;
ret = WP11_AesCtr_Do(pData, (word32)ulDataLen, pEncryptedData,
&encDataLen, session);
if (ret == WP11_CTR_OVERFLOW_E)
return CKR_DATA_LEN_RANGE;
if (ret != 0)
break;
*pulEncryptedDataLen = encDataLen;
Expand Down Expand Up @@ -3140,6 +3159,10 @@ CK_RV C_EncryptUpdate(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pPart,
encPartLen = (word32)*pulEncryptedPartLen;
ret = WP11_AesCtr_Update(pPart, (int)ulPartLen, pEncryptedPart,
&encPartLen, session);
if (ret == WP11_CTR_OVERFLOW_E) {
WP11_AesCtr_Final(session);
return CKR_DATA_LEN_RANGE;
}
if (ret < 0) {
WP11_Session_SetOpInitialized(session, 0);
return CKR_FUNCTION_FAILED;
Expand Down Expand Up @@ -3869,6 +3892,8 @@ CK_RV C_Decrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedData,
decDataLen = (word32)*pulDataLen;
ret = WP11_AesCtr_Do(pEncryptedData,
(word32)ulEncryptedDataLen, pData, &decDataLen, session);
if (ret == WP11_CTR_OVERFLOW_E)
return CKR_DATA_LEN_RANGE;
if (ret != 0)
break;
*pulDataLen = decDataLen;
Expand Down Expand Up @@ -4024,7 +4049,6 @@ CK_RV C_Decrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedData,
(word32)ulEncryptedDataLen, pData, &decDataLen, session);
if (ret == BUFFER_E) {
*pulDataLen = decDataLen;
WP11_Session_SetOpInitialized(session, 0);
return CKR_BUFFER_TOO_SMALL;
}
if (ret != 0)
Expand Down Expand Up @@ -4188,6 +4212,10 @@ CK_RV C_DecryptUpdate(CK_SESSION_HANDLE hSession,
decPartLen = (word32)*pulPartLen;
ret = WP11_AesCtr_Update(pEncryptedPart, (word32)ulEncryptedPartLen,
pPart, &decPartLen, session);
if (ret == WP11_CTR_OVERFLOW_E) {
WP11_AesCtr_Final(session);
return CKR_DATA_LEN_RANGE;
}
if (ret < 0) {
WP11_Session_SetOpInitialized(session, 0);
return CKR_FUNCTION_FAILED;
Expand Down
Loading
Loading