Skip to content

Fenrir Fixes - 1290,2110,1717 #580

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aidankeefe2022 wants to merge 1 commit into
base: master
Choose a base branch
from
+10 −8
Open

Fenrir Fixes - 1290,2110,1717 #580

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions dtls/client-dtls-cid.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,10 +141,11 @@ int main (int argc, char** argv)
printf("wolfSSL_read failed");
}
}

/* Add a terminating character to the generic server message */
recvLine[n] = '\0';
fputs(recvLine, stdout);
else {
/* Add a terminating character to the generic server message */
recvLine[n] = '\0';
fputs(recvLine, stdout);
}

close(sockfd);
if ( (sockfd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
Expand Down
5 changes: 3 additions & 2 deletions embedded/tls-info.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,9 +105,10 @@ static WC_INLINE void ShowX509Ex(WOLFSSL_X509* x509, const char* hdr,

/* testsuite has multiple threads writing to stdout, get output
message ready to write once */
strLen = sprintf(serialMsg, " %s", words[3]);
strLen = snprintf(serialMsg, sizeof(serialMsg), " %s", words[3]);
for (i = 0; i < sz; i++)
sprintf(serialMsg + strLen + (i*3), ":%02x ", serial[i]);
snprintf(serialMsg + strLen + (i*3),
((int)sizeof(serialMsg)) - strLen - (i*3), ":%02x ", serial[i]);

@wolfSSL-Fenrir-bot wolfSSL-Fenrir-bot Jun 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 [High] snprintf size goes negative — stack overflow on long cert serial still possible · Buffer overflows

Once strLen + i*3 exceeds 80 (peer serial ≥ ~24 bytes), the size ((int)sizeof(serialMsg)) - strLen - (i*3) is negative and converts to a huge size_t, while the destination serialMsg + strLen + i*3 is already past the 80-byte buffer, so a peer cert with a long serial overflows the stack.

Fix: Size serialMsg for the worst case (strLen + sz*3 + 1) and break out when the remaining size would be <= 0.

printf("%s\n", serialMsg);
}

Expand Down
4 changes: 2 additions & 2 deletions tls/memory-tls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,7 +153,7 @@ static void* client_thread(void* args)
wolfSSL_SetIORecv(cli_ctx, ClientRecv);

WOLFSSL* cli_ssl = wolfSSL_new(cli_ctx);
if (cli_ctx == NULL) err_sys("bad client new");
if (cli_ssl == NULL) err_sys("bad client new");

ret = wolfSSL_connect(cli_ssl);
if (ret != WOLFSSL_SUCCESS) err_sys("bad client tls connect");
Expand Down Expand Up @@ -185,7 +185,7 @@ int main()
wolfSSL_SetIORecv(srv_ctx, ServerRecv);

WOLFSSL* srv_ssl = wolfSSL_new(srv_ctx);
if (srv_ctx == NULL) err_sys("bad server new");
if (srv_ssl == NULL) err_sys("bad server new");

/* start client thread */
pthread_t tid;
Expand Down