Merge pull request #11926 from yosuke-wolfssl/fix/f-11725

Bound the DER re-encode in wolfSSL_ECDSA_do_verify under WOLF_CRYPTO_CB_ONLY_ECC

Author: SparkiDev

src/pk_ec.c

@@ -5484,12 +5484,20 @@ int wolfSSL_ECDSA_do_verify(const unsigned char *dgst, int dLen,
             ret = 0;
         }
 #else
-        signatureLen = i2d_ECDSA_SIG(sig, &p);
-        if (signatureLen > 0) {
+        signatureLen = wolfSSL_i2d_ECDSA_SIG(sig, NULL);
+        if ((signatureLen <= 0) || (signatureLen > (int)sizeof(signature))) {
+            WOLFSSL_MSG("wolfSSL_ECDSA_do_verify signature length error");
+            ret = WOLFSSL_FATAL_ERROR;
+        }
+        else if (wolfSSL_i2d_ECDSA_SIG(sig, &p) != signatureLen) {
+            WOLFSSL_MSG("wolfSSL_i2d_ECDSA_SIG failed");
+            ret = WOLFSSL_FATAL_ERROR;
+        }
+        else {
             /* verify hash. expects to call wc_CryptoCb_EccVerify internally */
-            ret = wc_ecc_verify_hash(signature, signatureLen, dgst,
-                (word32)dLen, &verified, (ecc_key*)key->internal);
-            if (ret != MP_OKAY) {
+            if (wc_ecc_verify_hash(signature, (word32)signatureLen, dgst,
+                    (word32)dLen, &verified, (ecc_key*)key->internal) !=
+                    MP_OKAY) {
                 WOLFSSL_MSG("wc_ecc_verify_hash failed");
                 ret = WOLFSSL_FATAL_ERROR;
             }
@@ -5498,10 +5506,6 @@ int wolfSSL_ECDSA_do_verify(const unsigned char *dgst, int dLen,
                 ret = 0;
             }
         }
-        else {
-            WOLFSSL_MSG("i2d_ECDSA_SIG failed");
-            ret = WOLFSSL_FATAL_ERROR;
-        }
 #endif /* WOLF_CRYPTO_CB_ONLY_ECC */
     }
 

tests/api/test_evp_pkey.c

@@ -3872,6 +3872,7 @@ int test_wolfSSL_EVP_PKEY_encoded_public_key(void)
         EVP_PKEY_free(pkey2);
     }
 
+#ifndef WOLF_CRYPTO_CB_ONLY_ECC
     /* set1 must produce a peer key usable for ECDH, i.e. the internal wolfCrypt
      * key (consumed by EVP_PKEY_derive) is synced, not just the wire bytes. */
     {
@@ -3936,6 +3937,7 @@ int test_wolfSSL_EVP_PKEY_encoded_public_key(void)
         EVP_PKEY_free(bob);
         EVP_PKEY_free(peer);
     }
+#endif /* !WOLF_CRYPTO_CB_ONLY_ECC */
 #endif /* HAVE_ECC */
 
 #ifdef HAVE_CURVE25519

tests/api/test_ossl_ec.c

@@ -300,7 +300,7 @@ int test_wolfSSL_i2d_ECPKParameters(void)
 int test_wolfSSL_EC_POINT(void)
 {
     EXPECT_DECLS;
-#if !defined(WOLFSSL_SP_MATH) && \
+#if !defined(WOLFSSL_SP_MATH) && !defined(WOLF_CRYPTO_CB_ONLY_ECC) && \
   (!defined(HAVE_FIPS) || (defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION>2)))
 
 #ifdef OPENSSL_EXTRA
@@ -1659,6 +1659,44 @@ int test_ECDSA_size_sign(void)
     return EXPECT_RESULT();
 }
 
+int test_ECDSA_do_verify_oversized_sig(void)
+{
+    EXPECT_DECLS;
+    /* NO_RSA builds may size big integers too small to hold an r of
+     * ECC_MAX_SIG_SIZE bytes. */
+#if defined(OPENSSL_EXTRA) && !defined(NO_ECC256) && !defined(NO_ECC_SECP) && \
+    !defined(NO_RSA)
+    EC_KEY* key = NULL;
+    ECDSA_SIG* sig = NULL;
+    BIGNUM* r = NULL;
+    BIGNUM* s = NULL;
+    byte hash[WC_MAX_DIGEST_SIZE];
+    byte big[ECC_MAX_SIG_SIZE];
+
+    XMEMSET(hash, 123, sizeof(hash));
+    XMEMSET(big, 0xff, sizeof(big));
+
+    ExpectNotNull(key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1));
+    ExpectNotNull(sig = ECDSA_SIG_new());
+    /* r alone DER encodes to more than ECC_MAX_SIG_SIZE bytes. */
+    ExpectNotNull(r = BN_bin2bn(big, (int)sizeof(big), NULL));
+    ExpectNotNull(s = BN_new());
+    ExpectIntEQ(BN_set_word(s, 1), 1);
+    ExpectIntEQ(ECDSA_SIG_set0(sig, r, s), 1);
+    if (EXPECT_FAIL()) {
+        BN_free(r);
+        BN_free(s);
+    }
+
+    ExpectIntEQ(ECDSA_do_verify(hash, sizeof(hash), sig, key),
+        WOLFSSL_FATAL_ERROR);
+
+    ECDSA_SIG_free(sig);
+    EC_KEY_free(key);
+#endif
+    return EXPECT_RESULT();
+}
+
 int test_ECDH_compute_key(void)
 {
     EXPECT_DECLS;

tests/api/test_ossl_ec.h

@@ -43,6 +43,7 @@ int test_wolfSSL_EC_KEY_print_fp(void);
 int test_wolfSSL_EC_get_builtin_curves(void);
 int test_wolfSSL_ECDSA_SIG(void);
 int test_ECDSA_size_sign(void);
+int test_ECDSA_do_verify_oversized_sig(void);
 int test_ECDH_compute_key(void);
 int test_d2i_ECPrivateKey_no_pubkey(void);
 int test_wolfSSL_EC_POINT_point2hex_oversized(void);
@@ -66,6 +67,7 @@ int test_wolfSSL_EC_POINT_point2hex_oversized(void);
     TEST_DECL_GROUP("ossl_ec", test_wolfSSL_EC_get_builtin_curves),         \
     TEST_DECL_GROUP("ossl_ec", test_wolfSSL_ECDSA_SIG),                     \
     TEST_DECL_GROUP("ossl_ec", test_ECDSA_size_sign),                       \
+    TEST_DECL_GROUP("ossl_ec", test_ECDSA_do_verify_oversized_sig),         \
     TEST_DECL_GROUP("ossl_ec", test_ECDH_compute_key),                      \
     TEST_DECL_GROUP("ossl_ec", test_d2i_ECPrivateKey_no_pubkey),            \
     TEST_DECL_GROUP("ossl_ec", test_wolfSSL_EC_POINT_point2hex_oversized)