Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(mbedtls): validate crypto input lengths (TEE OOB, auth-bypass, overflows)

Browse Source
This commit is contained in:
Ashish Sharma
2026-07-16 18:24:47 +08:00
parent 47e0435f99
commit 2e6f9b8b42
4 changed files with 84 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/mbedtls/esp_crt_bundle/esp_crt_bundle.c
+20 -2
View File
@@ -101,9 +101,11 @@ static const uint8_t* esp_crt_get_key(const cert_t cert)
return esp_crt_get_name(cert) + esp_crt_get_name_len(cert);
}
static uint16_t esp_crt_get_len(const cert_t cert)
static uint32_t esp_crt_get_len(const cert_t cert)
{
return CRT_HEADER_SIZE + esp_crt_get_name_len(cert) + esp_crt_get_key_len(cert);
/* Widened to uint32_t: name_len and key_len are each uint16_t, so their sum plus the
* header can exceed UINT16_MAX and would otherwise wrap, under-reporting the cert size. */
return (uint32_t)CRT_HEADER_SIZE + (uint32_t)esp_crt_get_name_len(cert) + (uint32_t)esp_crt_get_key_len(cert);
}
static uint32_t esp_crt_get_cert_offset(const bundle_t bundle, const uint32_t index)
@@ -428,6 +430,11 @@ static bool esp_crt_check_bundle(const uint8_t* const x509_bundle, const size_t
return false;
}
if (unlikely(num_certs == 0)) {
// No certificates: the loops below compute num_certs - 1, which would underflow.
return false;
}
// Check all offsets for consistency with certificate data
for (uint32_t i = 0; i < num_certs - 1; ++i) {
const uint32_t off = offsets[i];
@@ -440,6 +447,17 @@ static bool esp_crt_check_bundle(const uint8_t* const x509_bundle, const size_t
}
}
// The loop above stops at num_certs - 1, so the final certificate's extent is never
// validated; check it explicitly so its key data cannot run past the bundle (CWE-125).
const uint32_t last_off = offsets[num_certs - 1];
if (unlikely(last_off >= bundle_size)) {
return false;
}
const uint32_t last_len = esp_crt_get_len(x509_bundle + last_off);
if (unlikely((uint64_t)last_off + last_len > bundle_size)) {
return false;
}
// All checks passed.
return true;
}