From 5b3750c39fdcf4f5b41b9b54ec59a7660c6149d5 Mon Sep 17 00:00:00 2001 From: night1rider Date: Fri, 20 Mar 2026 13:48:14 -0600 Subject: [PATCH 1/2] Allow zero length inputs to _wc_Hash_Grow to be a succesful no-op Added '--enable-all CPPFLAGS=-DWOLFSSL_HASH_KEEP' to the make_check matrix in os-check.yml. --- .github/workflows/os-check.yml | 1 + wolfcrypt/src/hash.c | 7 ++++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/os-check.yml b/.github/workflows/os-check.yml index 4baea6b830f..38f7488f6b3 100644 --- a/.github/workflows/os-check.yml +++ b/.github/workflows/os-check.yml @@ -98,6 +98,7 @@ jobs: '--enable-curve25519=nonblock --enable-ecc=nonblock --enable-sp=yes,nonblock CPPFLAGS="-DWOLFSSL_PUBLIC_MP -DWOLFSSL_DEBUG_NONBLOCK"', '--enable-certreq --enable-certext --enable-certgen --disable-secure-renegotiation-info CPPFLAGS="-DNO_TLS"', '--enable-ocsp --enable-ocsp-responder --enable-ocspstapling CPPFLAGS="-DWOLFSSL_NONBLOCK_OCSP" --enable-maxfragment', + '--enable-all CPPFLAGS=-DWOLFSSL_HASH_KEEP', ] name: make check if: github.repository_owner == 'wolfssl' diff --git a/wolfcrypt/src/hash.c b/wolfcrypt/src/hash.c index 61f7aacd632..64a6308c911 100644 --- a/wolfcrypt/src/hash.c +++ b/wolfcrypt/src/hash.c @@ -1956,9 +1956,14 @@ int _wc_Hash_Grow(byte** msg, word32* used, word32* len, const byte* in, { word32 usedSz = 0; - if (inSz <= 0 || !WC_SAFE_SUM_WORD32(*used, (word32)inSz, usedSz)) + if (inSz < 0 || !WC_SAFE_SUM_WORD32(*used, (word32)inSz, usedSz)) return BAD_FUNC_ARG; + /* Allow zero-length input as a no-op. Some callers may pass zero-length + * data during hash operations and this should not be treated as an error. */ + if (inSz == 0) + return 0; + if (*len < usedSz) { if (*msg == NULL) { *msg = (byte*)XMALLOC(usedSz, heap, DYNAMIC_TYPE_TMP_BUFFER); From 92e3647a32ebe0abfa151597fc1c24b25e9ef7ce Mon Sep 17 00:00:00 2001 From: night1rider Date: Fri, 20 Mar 2026 16:11:09 -0600 Subject: [PATCH 2/2] Fix wc_MXC_TPU_SHA_Copy to deep copy src msg buffer instead of freed dst pointer --- wolfcrypt/src/port/maxim/max3266x.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/wolfcrypt/src/port/maxim/max3266x.c b/wolfcrypt/src/port/maxim/max3266x.c index c05c2781b04..4aed830c00a 100644 --- a/wolfcrypt/src/port/maxim/max3266x.c +++ b/wolfcrypt/src/port/maxim/max3266x.c @@ -808,23 +808,26 @@ int wc_MXC_TPU_SHA_Copy(void* src, void* dst, word32 ctxSz, byte** dstMsg, word32* dstUsed, word32* dstLen, void* dstHeap, void* srcHeap) { - byte* srcBuf; + byte* srcBuf = NULL; if (src == NULL || dst == NULL || dstMsg == NULL || dstUsed == NULL || dstLen == NULL || ctxSz == 0) { return BAD_FUNC_ARG; } - srcBuf = *dstMsg; - /* Free existing dst msg buffer using dst's original heap */ wc_MXC_TPU_SHA_Free(dstMsg, dstUsed, dstLen, dstHeap); /* Shallow copy the full context struct */ XMEMCPY(dst, src, ctxSz); - /* Deep copy src msg buffer if present, allocate using src's heap */ - if (srcBuf != NULL) { + /* Deep copy src msg buffer if present. Since dstMsg points into the dst + * struct, the XMEMCPY above overwrites it with the src's msg pointer. + * Save that pointer, allocate a new buffer for dst, and copy the data. + * Do NOT move srcBuf assignment before XMEMCPY - it must capture the + * src msg pointer that lands in *dstMsg after the shallow copy. */ + if (*dstMsg != NULL) { + srcBuf = *dstMsg; *dstMsg = (byte*)XMALLOC(*dstLen, srcHeap, DYNAMIC_TYPE_TMP_BUFFER); if (*dstMsg == NULL) { return MEMORY_E;