Fix crash in compliance tests#495
Open
gilles-peskine-arm wants to merge 7 commits intoMbed-TLS:developmentfrom
Open
Fix crash in compliance tests#495gilles-peskine-arm wants to merge 7 commits intoMbed-TLS:developmentfrom
gilles-peskine-arm wants to merge 7 commits intoMbed-TLS:developmentfrom
Conversation
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Without this patch, psa-arch-tests crashes on some platforms including our CI environment because libc detects a buffer overflow on the stack. This bug does not seem to be fixed upstream yet, so I will submit a fix. In the meantime, we'll need to carry the patch here. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
We don't implement `psa_key_derivation_verify_bytes()` and `psa_key_derivation_verify_key()` yet (the functions exist but they always return `PSA_ERROR_NOT_SUPPORTED`). Therefore, expect the tests for these functions to fail. These failures were previously undetected because psa-arch-tests was crashing due to a stack buffer overflow in AEAD tests. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Partial backport of 232fb5801273dbc97789cb9079f1168499e34a2a, first released in v25.08_API1.9_ADAC_1.0.2 . Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
There are memory errors in some PAKE tests that make psa-arch-tests crash. I am preparing patches for them, but until then, disable PAKE. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
gilles-peskine-arm
added
priority-high
github-project-automation
Bot
moved this to In Development
in Roadmap pull requests (new board)
gilles-peskine-arm
added
needs-review
3 tasks
gilles-peskine-arm
added
the
needs-preceding-pr
mpg
requested changes
Oct 6, 2025
Contributor
mpg
left a comment
mpg
left a comment
There was a problem hiding this comment.
LGTM except for an issue in a docstring.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In the PSA compliance tests, patch a memory error in
psa-arch-teststhat causes it to crash on environments such as our CI. This has been happening since #453; I realized the problem just after it was merged.I have a patch to fix the fact that out script doesn't detect the crash, but before we can merge it in the framework, we need to fix crypto so that it doesn't crash. In the meantime, we can check visually that psa-arch-tests ran until the end: in the log, the output ends with “Crypto suite report” with pass/fail/skip counts and
Entering standby...To keep the patching minimal, I only fix one set of memory errors. There are other errors that cause crashes in JPAKE tests, and more that don't cause a crash on our CI environment or my machine. I will upstream my fixes (at least some of them are not patched upstream), but in the meantime, we'll have to live with patches.
Since JPAKE is crashing and is currently not compliant anyway, disable it for now. We'll reenable it later, when we start fixing the JPAKE compliance issues.
Needs preceding PR: for a bug fix when there are expected failures.
PR checklist