Skip to content

Validate SHE client response payload size before use #457

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
yosuke-wolfssl wants to merge 1 commit into
base: main
Choose a base branch
from
+398 −19
Open

Validate SHE client response payload size before use #457

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
102 changes: 83 additions & 19 deletions src/wh_client_she.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ int wh_Client_SheSetUidResponse(whClientContext* c)
{
uint16_t group;
uint16_t action;
uint16_t dataSz;
uint16_t dataSz = 0;
int ret;
whMessageShe_SetUidResponse *resp = NULL;

Expand All @@ -96,6 +96,9 @@ int wh_Client_SheSetUidResponse(whClientContext* c)

resp = (whMessageShe_SetUidResponse*)wh_CommClient_GetDataPtr(c->comm);
ret = wh_Client_RecvResponse(c, &group, &action, &dataSz, (uint8_t*)resp);
if (ret == WH_ERROR_OK && dataSz < sizeof(*resp)) {
ret = WH_ERROR_ABORTED;
}
if (ret == WH_ERROR_OK) {
ret = resp->rc;
}
Expand All @@ -121,7 +124,7 @@ int wh_Client_SheSecureBoot(whClientContext* c, uint8_t* bootloader,
uint32_t bootloaderSent = 0;
uint16_t group;
uint16_t action;
uint16_t dataSz;
uint16_t dataSz = 0;
uint8_t* respBuf;

whMessageShe_SecureBootInitRequest* initReq = NULL;
Expand Down Expand Up @@ -149,6 +152,9 @@ int wh_Client_SheSecureBoot(whClientContext* c, uint8_t* bootloader,
ret = wh_Client_RecvResponse(c, &group, &action, &dataSz, respBuf);
initResp = (whMessageShe_SecureBootInitResponse*)respBuf;
} while (ret == WH_ERROR_NOTREADY);
if (ret == WH_ERROR_OK && dataSz < sizeof(*initResp)) {
ret = WH_ERROR_ABORTED;
}
}

/* send update sub command until we've sent the entire bootloader */
Expand Down Expand Up @@ -185,6 +191,10 @@ int wh_Client_SheSecureBoot(whClientContext* c, uint8_t* bootloader,
ret = wh_Client_RecvResponse(c, &group, &action, &dataSz,
respBuf);
} while (ret == WH_ERROR_NOTREADY);
if (ret == WH_ERROR_OK &&
dataSz < sizeof(whMessageShe_SecureBootUpdateResponse)) {
ret = WH_ERROR_ABORTED;
}
}

/* increment sent */
Expand All @@ -204,6 +214,9 @@ int wh_Client_SheSecureBoot(whClientContext* c, uint8_t* bootloader,
ret = wh_Client_RecvResponse(c, &group, &action, &dataSz, respBuf);
finishResp = (whMessageShe_SecureBootFinishResponse*)respBuf;
} while (ret == WH_ERROR_NOTREADY);
if (ret == WH_ERROR_OK && dataSz < sizeof(*finishResp)) {
ret = WH_ERROR_ABORTED;
}
}

if (ret == 0) {
Expand Down Expand Up @@ -231,7 +244,7 @@ int wh_Client_SheGetStatusResponse(whClientContext* c, uint8_t* sreg)
{
uint16_t group;
uint16_t action;
uint16_t dataSz;
uint16_t dataSz = 0;
int ret;
whMessageShe_GetStatusResponse *resp = NULL;

Expand All @@ -242,6 +255,9 @@ int wh_Client_SheGetStatusResponse(whClientContext* c, uint8_t* sreg)
resp = (whMessageShe_GetStatusResponse*)wh_CommClient_GetDataPtr(c->comm);

ret = wh_Client_RecvResponse(c, &group, &action, &dataSz, (uint8_t*)resp);
if (ret == WH_ERROR_OK && dataSz < sizeof(*resp)) {
ret = WH_ERROR_ABORTED;
}

/* return error or set sreg */
if (ret == 0) {
Expand Down Expand Up @@ -296,7 +312,7 @@ int wh_Client_SheLoadKeyResponse(whClientContext* c, uint8_t* messageFour,
int ret;
uint16_t group;
uint16_t action;
uint16_t dataSz;
uint16_t dataSz = 0;
whMessageShe_LoadKeyResponse* resp = NULL;

if (c == NULL || messageFour == NULL || messageFive == NULL) {
Expand All @@ -306,6 +322,9 @@ int wh_Client_SheLoadKeyResponse(whClientContext* c, uint8_t* messageFour,
resp = (whMessageShe_LoadKeyResponse*)wh_CommClient_GetDataPtr(c->comm);

ret = wh_Client_RecvResponse(c, &group, &action, &dataSz, (uint8_t*)resp);
if (ret == WH_ERROR_OK && dataSz < sizeof(*resp)) {
ret = WH_ERROR_ABORTED;
}
if (ret == 0) {
if (resp->rc != WH_SHE_ERC_NO_ERROR) {
ret = resp->rc;
Expand Down Expand Up @@ -355,7 +374,7 @@ int wh_Client_SheLoadPlainKeyResponse(whClientContext* c)
int ret;
uint16_t group;
uint16_t action;
uint16_t dataSz;
uint16_t dataSz = 0;
whMessageShe_LoadPlainKeyResponse* resp = NULL;

if (c == NULL) {
Expand All @@ -366,6 +385,9 @@ int wh_Client_SheLoadPlainKeyResponse(whClientContext* c)
(whMessageShe_LoadPlainKeyResponse*)wh_CommClient_GetDataPtr(c->comm);

ret = wh_Client_RecvResponse(c, &group, &action, &dataSz, (uint8_t*)resp);
if (ret == WH_ERROR_OK && dataSz < sizeof(*resp)) {
ret = WH_ERROR_ABORTED;
}
if (ret == 0) {
ret = resp->rc;
}
Expand Down Expand Up @@ -404,7 +426,7 @@ int wh_Client_SheExportRamKeyResponse(whClientContext* c, uint8_t* messageOne,
int ret;
uint16_t group;
uint16_t action;
uint16_t dataSz;
uint16_t dataSz = 0;
whMessageShe_ExportRamKeyResponse* resp = NULL;

if (c == NULL || messageOne == NULL || messageTwo == NULL ||
Expand All @@ -416,6 +438,9 @@ int wh_Client_SheExportRamKeyResponse(whClientContext* c, uint8_t* messageOne,
(whMessageShe_ExportRamKeyResponse*)wh_CommClient_GetDataPtr(c->comm);

ret = wh_Client_RecvResponse(c, &group, &action, &dataSz, (uint8_t*)resp);
if (ret == WH_ERROR_OK && dataSz < sizeof(*resp)) {
ret = WH_ERROR_ABORTED;
}
if (ret == 0) {
if (resp->rc != WH_SHE_ERC_NO_ERROR) {
ret = resp->rc;
Expand Down Expand Up @@ -464,7 +489,7 @@ int wh_Client_SheInitRndResponse(whClientContext* c)
int ret;
uint16_t group;
uint16_t action;
uint16_t dataSz;
uint16_t dataSz = 0;
whMessageShe_InitRngResponse* resp = NULL;

if (c == NULL) {
Expand All @@ -473,6 +498,9 @@ int wh_Client_SheInitRndResponse(whClientContext* c)

resp = (whMessageShe_InitRngResponse*)wh_CommClient_GetDataPtr(c->comm);
ret = wh_Client_RecvResponse(c, &group, &action, &dataSz, (uint8_t*)resp);
if (ret == WH_ERROR_OK && dataSz < sizeof(*resp)) {
ret = WH_ERROR_ABORTED;
}
if (ret == 0) {
ret = resp->rc;
}
Expand Down Expand Up @@ -506,7 +534,7 @@ int wh_Client_SheRndResponse(whClientContext* c, uint8_t* out, uint32_t* outSz)
int ret;
uint16_t group;
uint16_t action;
uint16_t dataSz;
uint16_t dataSz = 0;
whMessageShe_RndResponse* resp = NULL;

if (c == NULL || out == NULL || outSz == NULL || *outSz < WH_SHE_KEY_SZ) {
Expand All @@ -516,6 +544,9 @@ int wh_Client_SheRndResponse(whClientContext* c, uint8_t* out, uint32_t* outSz)
resp = (whMessageShe_RndResponse*)wh_CommClient_GetDataPtr(c->comm);

ret = wh_Client_RecvResponse(c, &group, &action, &dataSz, (uint8_t*)resp);
if (ret == WH_ERROR_OK && dataSz < sizeof(*resp)) {
ret = WH_ERROR_ABORTED;
}

if (ret == 0) {
if (resp->rc != WH_SHE_ERC_NO_ERROR)
Expand Down Expand Up @@ -567,7 +598,7 @@ int wh_Client_SheExtendSeedResponse(whClientContext* c)
int ret;
uint16_t group;
uint16_t action;
uint16_t dataSz;
uint16_t dataSz = 0;
whMessageShe_ExtendSeedResponse* resp = NULL;

if (c == NULL) {
Expand All @@ -576,6 +607,9 @@ int wh_Client_SheExtendSeedResponse(whClientContext* c)

resp = (whMessageShe_ExtendSeedResponse*)wh_CommClient_GetDataPtr(c->comm);
ret = wh_Client_RecvResponse(c, &group, &action, &dataSz, (uint8_t*)resp);
if (ret == WH_ERROR_OK && dataSz < sizeof(*resp)) {
ret = WH_ERROR_ABORTED;
}

if (ret == 0) {
ret = resp->rc;
Expand Down Expand Up @@ -625,7 +659,7 @@ int wh_Client_SheEncEcbResponse(whClientContext* c, uint8_t* out, uint32_t sz)
int ret;
uint16_t group;
uint16_t action;
uint16_t dataSz;
uint16_t dataSz = 0;
uint8_t* packOut;
whMessageShe_EncEcbResponse* resp = NULL;

Expand All @@ -640,9 +674,15 @@ int wh_Client_SheEncEcbResponse(whClientContext* c, uint8_t* out, uint32_t sz)

ret = wh_Client_RecvResponse(c, &group, &action, &dataSz, (uint8_t*)resp);
if (ret == 0) {
if (resp->rc != WH_SHE_ERC_NO_ERROR) {
if (dataSz < sizeof(*resp)) {
ret = WH_ERROR_ABORTED;
}
else if (resp->rc != WH_SHE_ERC_NO_ERROR) {
ret = resp->rc;
}
else if (resp->sz > (dataSz - sizeof(*resp))) {
ret = WH_ERROR_ABORTED;
}
else if (sz < resp->sz) {
ret = WH_ERROR_BADARGS;
}
Expand Down Expand Up @@ -698,7 +738,7 @@ int wh_Client_SheEncCbcResponse(whClientContext* c, uint8_t* out, uint32_t sz)
int ret;
uint16_t group;
uint16_t action;
uint16_t dataSz;
uint16_t dataSz = 0;
uint8_t* packOut;
whMessageShe_EncCbcResponse* resp = NULL;

Expand All @@ -712,9 +752,15 @@ int wh_Client_SheEncCbcResponse(whClientContext* c, uint8_t* out, uint32_t sz)

ret = wh_Client_RecvResponse(c, &group, &action, &dataSz, (uint8_t*)resp);
if (ret == 0) {
if (resp->rc != WH_SHE_ERC_NO_ERROR) {
if (dataSz < sizeof(*resp)) {
ret = WH_ERROR_ABORTED;
}
else if (resp->rc != WH_SHE_ERC_NO_ERROR) {
ret = resp->rc;
}
else if (resp->sz > (dataSz - sizeof(*resp))) {
ret = WH_ERROR_ABORTED;
}
else if (sz < resp->sz) {
ret = WH_ERROR_BADARGS;
}
Expand Down Expand Up @@ -766,7 +812,7 @@ int wh_Client_SheDecEcbResponse(whClientContext* c, uint8_t* out, uint32_t sz)
int ret;
uint16_t group;
uint16_t action;
uint16_t dataSz;
uint16_t dataSz = 0;
uint8_t* packOut;
whMessageShe_DecEcbResponse* resp = NULL;

Expand All @@ -780,9 +826,15 @@ int wh_Client_SheDecEcbResponse(whClientContext* c, uint8_t* out, uint32_t sz)

ret = wh_Client_RecvResponse(c, &group, &action, &dataSz, (uint8_t*)resp);
if (ret == 0) {
if (resp->rc != WH_SHE_ERC_NO_ERROR) {
if (dataSz < sizeof(*resp)) {
ret = WH_ERROR_ABORTED;
}
else if (resp->rc != WH_SHE_ERC_NO_ERROR) {
ret = resp->rc;
}
else if (resp->sz > (dataSz - sizeof(*resp))) {
ret = WH_ERROR_ABORTED;
}
else if (sz < resp->sz) {
ret = WH_ERROR_BADARGS;
}
Expand Down Expand Up @@ -838,7 +890,7 @@ int wh_Client_SheDecCbcResponse(whClientContext* c, uint8_t* out, uint32_t sz)
int ret;
uint16_t group;
uint16_t action;
uint16_t dataSz;
uint16_t dataSz = 0;
uint8_t* packOut;
whMessageShe_DecCbcResponse* resp = NULL;

Expand All @@ -852,9 +904,15 @@ int wh_Client_SheDecCbcResponse(whClientContext* c, uint8_t* out, uint32_t sz)

ret = wh_Client_RecvResponse(c, &group, &action, &dataSz, (uint8_t*)resp);
if (ret == 0) {
if (resp->rc != WH_SHE_ERC_NO_ERROR) {
if (dataSz < sizeof(*resp)) {
ret = WH_ERROR_ABORTED;
}
else if (resp->rc != WH_SHE_ERC_NO_ERROR) {
ret = resp->rc;
}
else if (resp->sz > (dataSz - sizeof(*resp))) {
ret = WH_ERROR_ABORTED;
}
else if (sz < resp->sz) {
ret = WH_ERROR_BADARGS;
}
Expand Down Expand Up @@ -908,7 +966,7 @@ int wh_Client_SheGenerateMacResponse(whClientContext* c, uint8_t* out,
int ret;
uint16_t group;
uint16_t action;
uint16_t dataSz;
uint16_t dataSz = 0;
whMessageShe_GenMacResponse* resp = NULL;

if (c == NULL || out == NULL || sz < WH_SHE_KEY_SZ) {
Expand All @@ -918,6 +976,9 @@ int wh_Client_SheGenerateMacResponse(whClientContext* c, uint8_t* out,
resp = (whMessageShe_GenMacResponse*)wh_CommClient_GetDataPtr(c->comm);

ret = wh_Client_RecvResponse(c, &group, &action, &dataSz, (uint8_t*)resp);
if (ret == WH_ERROR_OK && dataSz < sizeof(*resp)) {
ret = WH_ERROR_ABORTED;
}
if (ret == 0) {
if (resp->rc != WH_SHE_ERC_NO_ERROR) {
ret = resp->rc;
Expand Down Expand Up @@ -981,7 +1042,7 @@ int wh_Client_SheVerifyMacResponse(whClientContext* c, uint8_t* outStatus)
int ret;
uint16_t group;
uint16_t action;
uint16_t dataSz;
uint16_t dataSz = 0;
whMessageShe_VerifyMacResponse* resp = NULL;

if (c == NULL || outStatus == NULL) {
Expand All @@ -990,6 +1051,9 @@ int wh_Client_SheVerifyMacResponse(whClientContext* c, uint8_t* outStatus)

resp = (whMessageShe_VerifyMacResponse*)wh_CommClient_GetDataPtr(c->comm);
ret = wh_Client_RecvResponse(c, &group, &action, &dataSz, (uint8_t*)resp);
if (ret == WH_ERROR_OK && dataSz < sizeof(*resp)) {
ret = WH_ERROR_ABORTED;
}
if (ret == 0) {
if (resp->rc != WH_SHE_ERC_NO_ERROR) {
ret = resp->rc;
Expand Down
Loading
Loading