mirror of
https://github.com/yuzu-emu/mbedtls.git
synced 2024-12-23 06:35:31 +00:00
Add a test for signing content with a long ECDSA key
Due to the way the current PK API works, it may have not been clear for the library clients, how big output buffers they should pass to the signing functions. Depending on the key type they depend on MPI or EC specific compile-time constants. Inside the library, there were places, where it was assumed that the MPI size will always be enough, even for ECDSA signatures. However, for very small sizes of the MBEDTLS_MPI_MAX_SIZE and sufficiently large key, the EC signature could exceed the MPI size and cause a stack overflow. This test establishes both conditions -- small MPI size and the use of a long ECDSA key -- and attempts to sign an arbitrary file. This can cause a stack overvlow if the signature buffers are not big enough, therefore the test is performed for an ASan build.
This commit is contained in:
parent
4e36da32b3
commit
11f38e2f61
|
@ -745,6 +745,14 @@ server5.req.ku.sha1: server5.key
|
|||
$(MBEDTLS_CERT_REQ) output_file=$@ filename=$< key_usage=digital_signature,non_repudiation subject_name="C=NL,O=PolarSSL,CN=PolarSSL Server 1" md=SHA1
|
||||
all_final += server5.req.ku.sha1
|
||||
|
||||
###
|
||||
### A generic SECP521R1 private key
|
||||
###
|
||||
|
||||
secp521r1_prv.der:
|
||||
$(OPENSSL) ecparam -genkey -name secp521r1 -noout -out secp521r1_prv.der
|
||||
all_final += secp521r1_prv.der
|
||||
|
||||
################################################################
|
||||
### Generate CSRs for X.509 write test suite
|
||||
################################################################
|
||||
|
|
BIN
tests/data_files/secp521r1_prv.der
Normal file
BIN
tests/data_files/secp521r1_prv.der
Normal file
Binary file not shown.
|
@ -590,6 +590,23 @@ component_check_doxygen_warnings () {
|
|||
#### Build and test many configurations and targets
|
||||
################################################################
|
||||
|
||||
component_test_large_ecdsa_key_signature () {
|
||||
|
||||
SMALL_MPI_MAX_SIZE=136 # Small enough to interfere with the EC signatures
|
||||
|
||||
msg "build: cmake + MBEDTLS_MPI_MAX_SIZE=${SMALL_MPI_MAX_SIZE}, gcc, ASan" # ~ 1 min 50s
|
||||
scripts/config.pl set MBEDTLS_MPI_MAX_SIZE $SMALL_MPI_MAX_SIZE
|
||||
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
make
|
||||
|
||||
INEVITABLY_PRESENT_FILE=Makefile
|
||||
SIGNATURE_FILE="${INEVITABLY_PRESENT_FILE}.sig" # Warning, this is rm -f'ed below
|
||||
|
||||
msg "test: pk_sign secp521r1_prv.der for MBEDTLS_MPI_MAX_SIZE=${SMALL_MPI_MAX_SIZE} (ASan build)" # ~ 5s
|
||||
if_build_succeeded programs/pkey/pk_sign tests/data_files/secp521r1_prv.der $INEVITABLY_PRESENT_FILE
|
||||
rm -f $SIGNATURE_FILE
|
||||
}
|
||||
|
||||
component_test_default_out_of_box () {
|
||||
msg "build: make, default config (out-of-box)" # ~1min
|
||||
make
|
||||
|
|
Loading…
Reference in a new issue