Memory and Secret Handling Fixes#589
Conversation
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #589
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
stenslae
force-pushed
the
pr-memory-crypto
branch
from
9e04469 to
d324400
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #589
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
No new issues found in the changed files. ✅
stenslae
force-pushed
the
pr-memory-crypto
branch
from
d324400 to
34ccbb9
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #589
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
No new issues found in the changed files. ✅
stenslae
force-pushed
the
pr-memory-crypto
branch
3 times, most recently
from
c4beee5 to
76b1000
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #589
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
stenslae
force-pushed
the
pr-memory-crypto
branch
2 times, most recently
from
d490b56 to
e399570
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #589
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
stenslae
force-pushed
the
pr-memory-crypto
branch
from
e399570 to
3912200
Compare
stenslae
force-pushed
the
pr-memory-crypto
branch
from
3912200 to
0616752
Compare
stenslae
requested review from
wolfSSL-Fenrir-bot
and removed request for
wolfSSL-Fenrir-bot
…s, malloc/realloc NULL checks, and padding validation in crypto file-encryption examples
… F-6288: fix NULL-deref, fd-leak, unaligned-access, and buffer-overflow bugs across CAN, PKCS7, embedded, and PEM-printing examples
…ce hardcoded/UAF-prone secrets and keys with RNG-generated values, zeroize key material before free, and flag non-constant-time secret comparisons
stenslae
force-pushed
the
pr-memory-crypto
branch
from
0616752 to
2e36f5b
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #589
Scan targets checked: wolfssl-examples-bugs, wolfssl-examples-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
| salt[i] = input[i]; | ||
|
|
||
| if (ret == 0) { | ||
| ret = wc_InitRng(&rng); |
There was a problem hiding this comment.
🟠 [Medium] Unnecessary wc_InitRng error check in decrypt functions causes spurious failures · Logic errors
The PR adds an error check on wc_InitRng inside AesDecrypt, Des3Decrypt, AesCfbDecrypt, and CamelliaDecrypt, but the RNG is never used in any of these decrypt functions. If wc_InitRng fails, ret becomes non-zero and the entire decryption is skipped — a failure path that did not exist before (the old code ignored the return value and decrypted successfully regardless).
Fix: Remove wc_InitRng/wc_FreeRng and the rngInit flag entirely from these four decrypt functions, as they do not use the RNG.
3 participants
27 Fenrir fixes across wolfSSL example code in three commits: