20261023-smallstack-and-uninited-var-fixes

.github/workflows/smallStackSize.yml

@@ -1,3 +1,3 @@
 name: Stack Size warnings
 
 # START OF COMMON SECTION
@@ -82,17 +82,9 @@
             "--enable-faultharden",
             "CPPFLAGS=-DWOLFSSL_MLDSA_SIGN_SMALL_MEM -DWOLFSSL_MLDSA_VERIFY_SMALL_MEM -DWOLFSSL_MLDSA_MAKE_KEY_SMALL_MEM"]},
           {"name": "noasm-allcrypto-pq",
-           "configure": ["--disable-asm", "--enable-all-crypto",
-            "--enable-mlkem", "--enable-lms", "--enable-xmss", "--enable-mldsa"]},
-          {"name": "intelasm",
-           "configure": ["--enable-intelasm", "--enable-sp-asm"]},
-          {"name": "intelasm-pq",
-           "configure": ["--enable-intelasm", "--enable-sp-asm",
-            "--enable-mlkem", "--enable-lms", "--enable-xmss", "--enable-mldsa"]},
-          {"name": "intelasm-allcrypto-pq",
-           "configure": ["--enable-intelasm", "--enable-sp-asm",
-            "--enable-all-crypto", "--enable-mlkem", "--enable-lms",
-            "--enable-xmss", "--enable-mldsa"]}
+           "configure": ["--disable-asm", "--enable-all-crypto", "--enable-testcert", "--enable-all-quantum-crypto"]},
+          {"name": "all-asm-allcrypto-pq",
+           "configure": ["--enable-all-asm", "--enable-all-crypto", "--enable-testcert", "--enable-all-quantum-crypto"]}
           ]}
           EOF
           .github/scripts/parallel-make-check.py \

m4/ax_vcs_checkout.m4

@@ -45,19 +45,22 @@
 #  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 #  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-#serial 6.1
+#serial 6.2
 #
 # Added tweak for git. The base repo's .git is a directory. Any worktree's
 # .git is a file. Use -e to check for either dir or file.
 
+# 6.2 adds ${srcdir} to the tests, so that detection works as expected in
+# out-of-tree builds.
+
 AC_DEFUN([AX_VCS_SYSTEM],
     [AC_PREREQ([2.63])dnl
     AC_CACHE_CHECK([for vcs system], [ac_cv_vcs_system],
       [ac_cv_vcs_system="none"
-      AS_IF([test -d ".bzr"],[ac_cv_vcs_system="bazaar"])
-      AS_IF([test -d ".svn"],[ac_cv_vcs_system="svn"])
-      AS_IF([test -d ".hg"],[ac_cv_vcs_system="mercurial"])
-      AS_IF([test -e ".git"],[ac_cv_vcs_system="git"])
+      AS_IF([test -d "${srcdir}/.bzr"],[ac_cv_vcs_system="bazaar"])
+      AS_IF([test -d "${srcdir}/.svn"],[ac_cv_vcs_system="svn"])
+      AS_IF([test -d "${srcdir}/.hg"],[ac_cv_vcs_system="mercurial"])
+      AS_IF([test -e "${srcdir}/.git"],[ac_cv_vcs_system="git"])
       ])
     AC_DEFINE_UNQUOTED([VCS_SYSTEM],["$ac_cv_vcs_system"],[VCS system])
     ])

src/internal.c

@@ -46731,7 +46731,7 @@ static int DefTicketEncCb(WOLFSSL* ssl, byte key_name[WOLFSSL_TICKET_NAME_SZ],
                 #ifndef NO_RSA
                     case rsa_kea:
                     {
-                        word32 keySz;
+                        word32 keySz = 0;
 
                         ssl->buffers.keyType = rsa_sa_algo;
                         ret = DecodePrivateKey(ssl, &keySz);
@@ -46820,7 +46820,7 @@ static int DefTicketEncCb(WOLFSSL* ssl, byte key_name[WOLFSSL_TICKET_NAME_SZ],
                         if (ssl->specs.static_ecdh &&
                                           ssl->ecdhCurveOID != ECC_X25519_OID &&
                                           ssl->ecdhCurveOID != ECC_X448_OID) {
-                            word32 keySz;
+                            word32 keySz = 0;
 
                             ssl->buffers.keyType = ecc_dsa_sa_algo;
                             ret = DecodePrivateKey(ssl, &keySz);

wolfcrypt/src/aes.c

@@ -9224,6 +9224,7 @@ int wc_AesGcmSetKey(Aes* aes, const byte* key, word32 len)
     int  ret;
     byte iv[WC_AES_BLOCK_SIZE];
     byte nonce[WC_AES_BLOCK_SIZE];
+    const byte* setKeyIv = iv;
 
     #ifdef WOLFSSL_IMX6_CAAM_BLOB
         byte   local[32];
@@ -9266,9 +9267,9 @@ int wc_AesGcmSetKey(Aes* aes, const byte* key, word32 len)
     /* Keep a nonce cached by wc_AesGcmSetIV() or wc_AesGcmSetExtIV(). */
     if (aes->nonceSz != 0) {
         XMEMCPY(nonce, aes->reg, sizeof(nonce));
+        setKeyIv = nonce;
     }
-    ret = wc_AesSetKey(aes, key, len, (aes->nonceSz != 0) ? nonce : iv,
-        AES_ENCRYPTION);
+    ret = wc_AesSetKey(aes, key, len, setKeyIv, AES_ENCRYPTION);
 #ifndef WOLFSSL_NO_AES_TAG_ASSOCIATION
     /* new key, so the tag length of the old one no longer applies */
     if (ret == 0) {

wolfcrypt/src/pkcs12.c

@@ -1095,7 +1095,7 @@ int wc_i2d_PKCS12(WC_PKCS12* pkcs12, byte** der, int* derSz)
         XMEMCPY(&buf[idx], pkcs12->safe->data, pkcs12->safe->dataSz);
         idx += pkcs12->safe->dataSz;
 
-        if (pkcs12->signData != NULL) {
+        if (sdBuf != NULL) {
             XMEMCPY(&buf[idx], sdBuf, sdBufSz);
         }
 

wolfcrypt/src/random.c

@@ -1720,6 +1720,7 @@ static WARN_UNUSED_RESULT int Hash_gen(DRBG_internal* drbg, byte* out,
     wc_MemZero_Add("Hash_gen data", data, DRBG_SEED_LEN);
 #ifndef WOLFSSL_SMALL_STACK_CACHE
     /* cached digest is the caller's drbg->digest_scratch, already registered */
+    XMEMSET(digest, 0, WC_SHA256_DIGEST_SIZE);
     wc_MemZero_Add("Hash_gen digest", digest, WC_SHA256_DIGEST_SIZE);
 #endif
 #endif
@@ -4305,15 +4306,15 @@ int wc_InitRngNonce_UserSeed(WC_RNG* rng,
         return BAD_FUNC_ARG;
     if (rng == NULL)
         return BAD_FUNC_ARG;
-    if (seed == NULL && seedSz != 0)
-        return BAD_FUNC_ARG;
     if (nonce == NULL && nonceSz != 0)
         return BAD_FUNC_ARG;
     if (perso == NULL && persoSz != 0)
         return BAD_FUNC_ARG;
 #ifdef HAVE_HASHDRBG
     if (seedSz < UserSeedSzFloor(flags))
         return BAD_LENGTH_E;
+#else
+    (void)seedSz;
 #endif
 #ifndef WC_RNG_HAVE_RBGC
     /* argument-legal calls must be refused if provenance tracking (RBGC) isn't

wolfcrypt/src/wc_xmss_impl.c

@@ -2503,7 +2503,7 @@ static void wc_xmss_n_way_fused_get(XmssState* state, word32 lanes, word32 l,
          * the state that way too. */
         for (i = 0; i < 4; i++) {
             word64 v = state->n_way_state[i * lanes + l];
-            int k;
+            word32 k;
 
             for (k = 0; k < 8; k++) {
                 out[i * 8 + k] = (byte)(v >> (8 * k));
@@ -2516,7 +2516,7 @@ static void wc_xmss_n_way_fused_get(XmssState* state, word32 lanes, word32 l,
     if (state->params->n == XMSS_SHA512_64_N) {
         for (i = 0; i < 8; i++) {
             word64 v = state->n_way_st512[i * lanes + l];
-            int k;
+            word32 k;
 
             for (k = 0; k < 8; k++) {
                 out[i * 8 + k] = (byte)(v >> ((7 - k) * 8));
@@ -2556,7 +2556,7 @@ static void wc_xmss_n_way_fused_set(XmssState* state, word32 lanes, word32 l,
             int k;
 
             for (k = 7; k >= 0; k--) {
-                t = (t << 8) | (word64)v[i * 8 + k];
+                t = (t << 8) | (word64)v[i * 8 + (word32)k];
             }
             state->n_way_state[i * lanes + l] = t;
         }
@@ -2567,7 +2567,7 @@ static void wc_xmss_n_way_fused_set(XmssState* state, word32 lanes, word32 l,
     if (state->params->n == XMSS_SHA512_64_N) {
         for (i = 0; i < 8; i++) {
             word64 t = 0;
-            int k;
+            word32 k;
 
             for (k = 0; k < 8; k++) {
                 t = (t << 8) | (word64)v[i * 8 + k];
@@ -2643,13 +2643,13 @@ static void wc_xmss_n_way_fused_step(XmssState* state, const byte* addr,
         for (i = 0; i < 2U * XMSS_SHA256_32_N / 8U; i++) {
             pfx[i] = 0;
             for (k = 7; k >= 0; k--) {
-                pfx[i] = (pfx[i] << 8) | (word64)state->prf_buf[i * 8 + k];
+                pfx[i] = (pfx[i] << 8) | (word64)state->prf_buf[i * 8 + (word32)k];
             }
         }
         for (i = 0; i < (WC_XMSS_ADDR_LEN / 8); i++) {
             adrs[i] = 0;
             for (k = 7; k >= 0; k--) {
-                adrs[i] = (adrs[i] << 8) | (word64)addr[i * 8 + k];
+                adrs[i] = (adrs[i] << 8) | (word64)addr[i * 8 + (word32)k];
             }
         }
         /* The kernel masks out the two bytes that vary between lanes; the