Skip to content

More various fixes (F-*)#30

Merged
gasbytes merged 26 commits into
wolfSSL:mainfrom
gasbytes:2026-06-14-findings-fixes
Jun 22, 2026
Merged

More various fixes (F-*)#30
gasbytes merged 26 commits into
wolfSSL:mainfrom
gasbytes:2026-06-14-findings-fixes

Conversation

@gasbytes

Copy link
Copy Markdown
Contributor

eca9700 - Added Ed25519KeyPair to prevent type_complexity warning (cargo clippy) from flagging and to make it more readable
29a7fba - cargo fmt formatting
7e494c4 - remove unnecessary wc_ecc_curve_id call
e5bd0e0 - check the digest size after getting its size from the hash type
e3484f4 - remove unnecessary bitwise copy of RsaKey(s) and its deferencing, use size_of the type directly instead
6ad05ae - move test related crates from dependencies to dev-dependencies instead since they are not used in the library
5380da7 - propage init() failures to callers instead of panicking, so a failed wc_init* surfaces as a retriaviable error
2c979db - zeroize ecdsa exported scalar in case of exit on error in the case of unsupported keys
c23a34d - zeroize der(s) after try_from logic in rsa.rs in case of failure during the importing
956fe83 - zeroize key material in stored in the stack kx modules and not only in the heap
ddec026 - remove duplicate entry of RSA_PKCS1_SHA512 from the ALGORITHMS slice
26489a3 - make error clearer when expanding a slice in expand_block in hkdf.rs
91a0ead - removed manual free that was skipped on panic, using again the automatic drop calls via src/types/mod.rs
4390d38 - make hmacobject own its cleanup via the define_foreign_type_no_copy! macro in src/types/mod.rs
a05ad21 - free allocated Hmac object in case of failure from wc_HmacSetKey
e4878fe - removed sha*hmac modules, since they were merged into src/hmac/mod.rs which implements both
e759e19 - check returned value of wc_SignatureGetSize should be greater than zero on success (indicates maximum size of the signature)
f62dbb9 - fix data race in quic aes/chacha ciphers by allocating a fresh wolfcrypt context per encrypt/decrypt call instead of mutating shared C state
through &self
b4ae459 - remove derive(copy) from the chachaobject since no code copies it as of now
6172aec - fix heap leak of boxed aes/chacha in quic ciphers by freeing the box in aescipher/chachacipher drop and on the aesinit error path
54c0bf3 - reuse a single raw pointer for the in/out buffer in all aead encrypt/decrypt ffi calls to avoid stacked borrows provenance invalidation (UB under
miri)
088672d - added missing checks to validate sample length (quic) before encrypting both for aes and chacha20
8a20ba3 - run the quic tests in the ci/cd
6075ea9 - added missing checks in quic.rs against the tag_len, to make sure the cipher text is not malformed
427f921 - added proper checks against 24 bytes cipher text (aes128/256gcm)

gasbytes added 25 commits June 16, 2026 04:08
…decrypt ffi calls to avoid stacked borrows provenance invalidation

(UB under miri)
…in aescipher/chachacipher drop and on the aesinit error path
…ypt context per encrypt/decrypt call instead of mutating shared C state through &self
should be greater than zero on success (indicates maximum size of the
signature)
…) from flagging and to make it more readable
@gasbytes gasbytes self-assigned this Jun 17, 2026
@gasbytes gasbytes marked this pull request as ready for review June 17, 2026 14:11
@gasbytes gasbytes assigned holtrop-wolfssl and unassigned gasbytes Jun 17, 2026
@gasbytes gasbytes requested a review from holtrop-wolfssl June 17, 2026 16:00
Comment thread rustls-wolfcrypt-provider/src/sign/rsa.rs Outdated
@gasbytes gasbytes merged commit b6457e0 into wolfSSL:main Jun 22, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants