Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'fix/crt-bundle-unaligned-reads_v6.1' into 'release/v6.1'

Browse Source 
fix(mbedtls): read crt bundle byte-wise to avoid misaligned flash access (v6.1)

See merge request espressif/esp-idf!51723
This commit is contained in:
Mahavir Jain
2026-09-04 11:00:13 +05:30
parent 027c75bb0a 1612b25e70
commit 156d8938f1
2 changed files with 22 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/mbedtls/esp_crt_bundle/esp_crt_bundle.c
+20 -15
View File
@@ -71,14 +71,19 @@ typedef const uint8_t* cert_t;
static bundle_t s_crt_bundle;
// Read a 16-bit value stored in little-endian format from the given address
/* Read little-endian values byte-wise: bundle fields are byte-packed with no
* alignment guarantee, and a misaligned load from flash can spuriously fault
* on chips with SOC_CPU_MISALIGNED_ACCESS_ON_PMP_MISMATCH_ISSUE (DIG-694).
*/
static uint16_t get16_le(const uint8_t* ptr)
{
#if defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
return *((const uint16_t*)ptr);
#else
return (((uint16_t)ptr[1]) << 8) | ptr[0];
#endif
return (uint16_t)ptr[0] | ((uint16_t)ptr[1] << 8);
}
static uint32_t get32_le(const uint8_t* ptr)
{
return (uint32_t)ptr[0] | ((uint32_t)ptr[1] << 8)
| ((uint32_t)ptr[2] << 16) | ((uint32_t)ptr[3] << 24);
}
static uint16_t esp_crt_get_name_len(const cert_t cert)
@@ -110,7 +115,7 @@ static uint32_t esp_crt_get_len(const cert_t cert)
static uint32_t esp_crt_get_cert_offset(const bundle_t bundle, const uint32_t index)
{
return ((const uint32_t*)bundle)[index];
return get32_le(bundle + index * sizeof(uint32_t));
}
static uint32_t esp_crt_get_certcount(const bundle_t bundle)
@@ -409,16 +414,15 @@ static bool esp_crt_check_bundle(const uint8_t* const x509_bundle, const size_t
return false;
}
// Pointer to the first offset entry
const uint32_t* offsets = (const uint32_t*)x509_bundle;
if (unlikely(offsets[0] == 0 || (offsets[0] % sizeof(uint32_t)) != 0)) {
// The bundle base may be unaligned; read offsets byte-wise via esp_crt_get_cert_offset()
if (unlikely(esp_crt_get_cert_offset(x509_bundle, 0) == 0
|| (esp_crt_get_cert_offset(x509_bundle, 0) % sizeof(uint32_t)) != 0)) {
// First offset is invalid.
// The first certificate must start after N uint32_t offset values.
return false;
}
if (unlikely(offsets[0] >= bundle_size)) {
if (unlikely(esp_crt_get_cert_offset(x509_bundle, 0) >= bundle_size)) {
// First cert starts beyond end of bundle
return false;
}
@@ -437,7 +441,7 @@ static bool esp_crt_check_bundle(const uint8_t* const x509_bundle, const size_t
// Check all offsets for consistency with certificate data
for (uint32_t i = 0; i < num_certs - 1; ++i) {
const uint32_t off = offsets[i];
const uint32_t off = esp_crt_get_cert_offset(x509_bundle, i);
if (unlikely((uint64_t)off + CRT_HEADER_SIZE > bundle_size)) {
return false;
}
@@ -445,14 +449,15 @@ static bool esp_crt_check_bundle(const uint8_t* const x509_bundle, const size_t
// The next offset in the list must point to right after the current cert
const uint32_t expected_next_offset = off + esp_crt_get_len(cert);
if (unlikely(offsets[i + 1] != expected_next_offset || expected_next_offset >= bundle_size)) {
if (unlikely(esp_crt_get_cert_offset(x509_bundle, i + 1) != expected_next_offset
|| expected_next_offset >= bundle_size)) {
return false;
}
}
// The loop above stops at num_certs - 1, so the final certificate's extent is never
// validated; check it explicitly so its key data cannot run past the bundle (CWE-125).
const uint32_t last_off = offsets[num_certs - 1];
const uint32_t last_off = esp_crt_get_cert_offset(x509_bundle, num_certs - 1);
if (unlikely((uint64_t)last_off + CRT_HEADER_SIZE > bundle_size)) {
return false;
}
tools/cmake/scripts/data_file_embed_asm.cmake
+2
View File
@@ -83,6 +83,8 @@ append("${data}")
make_and_append_identifier("_binary_${varname}_end" "for objcopy compatibility")
append_line("")
# Keep the length aligned on the word boundary (read as a 32-bit `<name>_length`)
append_line(".balign 4")
if(FILE_TYPE STREQUAL "TEXT")
make_and_append_identifier("${varname}_length" "not including null byte")
else()