nasa · Donnie-Ice · Jun 23, 2025 · May 6, 2025 · May 6, 2025 · May 6, 2025
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -172,7 +172,7 @@ jobs:
     - name: Update
       run: yum update -y
     - name: Install Dependencies
-      run: yum install -y --enablerepo=devel python3-pip python3-devel epel-release libcurl-devel git cmake gcc java-11-openjdk-devel openssl wget bzip2 ldconfig mariadb-devel mariadb-common mariadb-connector-c mariadb-connector-c-config mariadb-errmsg mariadb-gssapi-server
+      run: yum install -y --enablerepo=devel python3-pip python3-devel epel-release libcurl-devel git cmake gcc java-11-openjdk-devel openssl wget bzip2 ldconfig mariadb-devel mariadb-common mariadb-connector-c mariadb-connector-c-config mariadb-errmsg mariadb-gssapi-server libasan
       # Might want to trim this down, but these dependencies should work for KMC
     - name: install lcov
       run: yum install -y --enablerepo=epel lcov

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -22,7 +22,7 @@ jobs:
     name: Analyze Build_Internal
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
     container:
-        image: ivvitc/cryptolib:20250102
+        image: ivvitc/cryptolib:20250108
     permissions:
       # required for all workflows
       security-events: write
@@ -74,7 +74,7 @@ jobs:
       name: Analyze Build_Minimal
       runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
       container:
-        image: ivvitc/cryptolib:20250102
+        image: ivvitc/cryptolib:20250108
       permissions:
         # required for all workflows
         security-events: write
@@ -126,7 +126,7 @@ jobs:
       name: Analyze Build_Wolf
       runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
       container:
-        image: ivvitc/cryptolib:20250102
+        image: ivvitc/cryptolib:20250108
       permissions:
         # required for all workflows
         security-events: write
@@ -204,7 +204,7 @@ jobs:
       name: Analyze Build_RHEL
       runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
       container:
-        image: ivvitc/cryptolib:20250102
+        image: ivvitc/cryptolib:20250108
       permissions:
         # required for all workflows
         security-events: write
@@ -256,7 +256,7 @@ jobs:
     name: Analyze Build_EP
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
     container:
-        image: ivvitc/cryptolib:20250102
+        image: ivvitc/cryptolib:20250108
     permissions:
       # required for all workflows
       security-events: write

diff --git a/include/crypto.h b/include/crypto.h
@@ -361,8 +361,7 @@ extern uint32_t crc32Table[CRC32TBL_SIZE];
 extern uint16_t crc16Table[CRC16TBL_SIZE];
 
 // GF(2^4) field and logarithm tables
-static const uint8_t gf_exp[30] = {1, 2, 4, 8, 3, 6, 12, 11, 5, 10, 7, 14, 15, 13, 9,
-                                   1, 2, 4, 8, 3, 6, 12, 11, 5, 10, 7, 14, 15, 13, 9};
+static const uint8_t gf_exp[15] = {1, 2, 4, 8, 3, 6, 12, 11, 5, 10, 7, 14, 15, 13, 9};
 
 static const uint8_t gf_log[GF_SIZE] = {0, 0, 1, 4, 2, 8, 5, 10, 3, 14, 9, 7, 6, 13, 11, 12};
 

diff --git a/src/core/crypto.c b/src/core/crypto.c
@@ -465,8 +465,11 @@ uint16_t Crypto_Calc_FHECF(uint8_t *data)
     memset(parity, 0, RS_PARITY);
     for (i = 0; i < RS_DATA; i++)
     {
-        feedback = data[i] ^ parity[0];
-        memcpy(&parity[0], &parity[1], RS_PARITY - 1);
+        feedback = (data[i] ^ parity[0]) % (GF_SIZE - 1);
+        for (j = 0; j < RS_PARITY - 1; j++)
+        {
+            parity[j] = parity[j + 1];
+        }
         parity[RS_PARITY - 1] = 0;
 
         for (j = 0; j < RS_PARITY; j++)

diff --git a/src/core/crypto_aos.c b/src/core/crypto_aos.c
@@ -1195,12 +1195,14 @@ int32_t Crypto_AOS_ProcessSecurity(uint8_t *p_ingest, uint16_t len_ingest, uint8
             {
                 status = CRYPTO_LIB_ERR_KEY_ID_ERROR;
                 mc_if->mc_log(status);
+                free(p_new_dec_frame);
                 return status;
             }
             if (ekp->key_state != KEY_ACTIVE)
             {
                 status = CRYPTO_LIB_ERR_KEY_STATE_INVALID;
                 mc_if->mc_log(status);
+                free(p_new_dec_frame);
                 return status;
             }
         }
@@ -1214,12 +1216,14 @@ int32_t Crypto_AOS_ProcessSecurity(uint8_t *p_ingest, uint16_t len_ingest, uint8
             {
                 status = CRYPTO_LIB_ERR_KEY_ID_ERROR;
                 mc_if->mc_log(status);
+                free(p_new_dec_frame);
                 return status;
             }
             if (akp->key_state != KEY_ACTIVE)
             {
                 status = CRYPTO_LIB_ERR_KEY_STATE_INVALID;
                 mc_if->mc_log(status);
+                free(p_new_dec_frame);
                 return status;
             }
         }

diff --git a/src/core/crypto_tc.c b/src/core/crypto_tc.c
@@ -252,7 +252,6 @@ int32_t Crypto_TC_Frame_Validation(uint16_t *p_enc_frame_len)
         printf(KRED "Error: New frame would violate maximum tc frame managed parameter! \n" RESET);
         status = CRYPTO_LIB_ERR_TC_FRAME_SIZE_EXCEEDS_MANAGED_PARAM_MAX_LIMIT;
         mc_if->mc_log(status);
-        printf("STATUS=%d\n", status);
         return status;
     }
     // Ensure the frame to be created will not violate spec max length
@@ -261,6 +260,7 @@ int32_t Crypto_TC_Frame_Validation(uint16_t *p_enc_frame_len)
         printf(KRED "Error: New frame would violate specification max TC frame size! \n" RESET);
         status = CRYPTO_LIB_ERR_TC_FRAME_SIZE_EXCEEDS_SPEC_LIMIT;
         mc_if->mc_log(status);
+        return status;
     }
     return status;
 }
@@ -399,12 +399,14 @@ int32_t Crypto_TC_Encrypt(uint8_t sa_service_type, SecurityAssociation_t *sa_ptr
             {
                 status = CRYPTO_LIB_ERR_KEY_ID_ERROR;
                 mc_if->mc_log(status);
+                free(p_new_enc_frame);
                 return status;
             }
             if (ekp->key_state != KEY_ACTIVE)
             {
                 status = CRYPTO_LIB_ERR_KEY_STATE_INVALID;
                 mc_if->mc_log(status);
+                free(p_new_enc_frame);
                 return status;
             }
         }
@@ -418,12 +420,14 @@ int32_t Crypto_TC_Encrypt(uint8_t sa_service_type, SecurityAssociation_t *sa_ptr
             {
                 status = CRYPTO_LIB_ERR_KEY_ID_ERROR;
                 mc_if->mc_log(status);
+                free(p_new_enc_frame);
                 return status;
             }
             if (akp->key_state != KEY_ACTIVE)
             {
                 status = CRYPTO_LIB_ERR_KEY_STATE_INVALID;
                 mc_if->mc_log(status);
+                free(p_new_enc_frame);
                 return status;
             }
         }
@@ -681,7 +685,6 @@ int32_t Crypto_TC_Do_Encrypt(uint8_t sa_service_type, SecurityAssociation_t *sa_
                                aad, ecs_is_aead_algorithm, index_p, p_in_frame, cam_cookies, pkcs_padding);
     if (status != CRYPTO_LIB_SUCCESS)
     {
-        Crypto_TC_Safe_Free_Ptr(*aad);
         mc_if->mc_log(status);
         return status;
     }
@@ -1110,11 +1113,11 @@ int32_t Crypto_TC_ApplySecurity_Cam(const uint8_t *p_in_frame, const uint16_t in
     // Determine if segment header exists and FECF exists
     uint8_t segment_hdr_len = TC_SEGMENT_HDR_SIZE;
     uint8_t fecf_len        = FECF_SIZE;
-    uint8_t ocf_len         = TELEMETRY_FRAME_OCF_CLCW_SIZE;
+    uint8_t ocf_len         = OCF_SIZE;
     Crypto_TC_Calc_Lengths(&fecf_len, &segment_hdr_len, &ocf_len);
 
     // Calculate tf_payload length here to be used in other logic
-    int16_t payload_calc = temp_tc_header.fl - TC_FRAME_HEADER_SIZE - segment_hdr_len - fecf_len + 1;
+    int16_t payload_calc = (temp_tc_header.fl + 1) - TC_FRAME_HEADER_SIZE - segment_hdr_len - ocf_len - fecf_len;
     // check if payload length underflows
     if (payload_calc < 0)
     {
@@ -1140,8 +1143,8 @@ int32_t Crypto_TC_ApplySecurity_Cam(const uint8_t *p_in_frame, const uint16_t in
     */
 
     // Calculate frame lengths based on SA fields
-    *p_enc_frame_len =
-        temp_tc_header.fl + 1 + 2 + sa_ptr->shivf_len + sa_ptr->shsnf_len + sa_ptr->shplf_len + sa_ptr->stmacf_len;
+    *p_enc_frame_len = temp_tc_header.fl + 1 + SPI_LEN + sa_ptr->shivf_len + sa_ptr->shsnf_len + sa_ptr->shplf_len +
+                       sa_ptr->stmacf_len + ocf_len;
     new_enc_frame_header_field_length = (*p_enc_frame_len) - 1;
 
     // Finalize frame setup
@@ -1330,13 +1333,13 @@ int32_t Crypto_TC_Parse_Check_FECF(uint8_t *ingest, int *len_ingest, TC_t *tc_sd
             // Calculate our own
             uint16_t calculated_fecf = Crypto_Calc_FECF(ingest, *len_ingest - 2);
             // Compare
-            if (received_fecf != calculated_fecf)
-            {
 #ifdef DEBUG
-                printf("Received FECF is 0x%04X\n", received_fecf);
-                printf("Calculated FECF is 0x%04X\n", calculated_fecf);
-                printf("FECF was Calced over %d bytes\n", *len_ingest - 2);
+            printf("Received FECF is 0x%04X\n", received_fecf);
+            printf("Calculated FECF is 0x%04X\n", calculated_fecf);
+            printf("FECF was Calced over %d bytes\n", *len_ingest - 2);
 #endif
+            if (received_fecf != calculated_fecf)
+            {
                 status = CRYPTO_LIB_ERR_INVALID_FECF;
                 mc_if->mc_log(status);
             }

diff --git a/src/core/crypto_tm.c b/src/core/crypto_tm.c
@@ -926,7 +926,7 @@ int32_t Crypto_TM_ApplySecurity(uint8_t *pTfBuffer, uint16_t len_ingest)
     printf("Actual secondary header length: %d\n", secondary_hdr_len);
 #endif
     // Only validate SHVN if secondary header is present
-    if (idx > secondary_hdr_start && shvn > 3) // SHVN is 2 bits, so max value is 3
+    if (idx > secondary_hdr_start && shvn > 0) // SHVN is 2 bits, 0b00 is the only allowed value
     {
         status = CRYPTO_LIB_ERR_TM_SECONDARY_HDR_VN;
         mc_if->mc_log(status);
@@ -957,9 +957,10 @@ int32_t Crypto_TM_ApplySecurity(uint8_t *pTfBuffer, uint16_t len_ingest)
      **/
 
     // Set SPI
-    pTfBuffer[idx]     = ((sa_ptr->spi & 0xFF00) >> 8);
-    pTfBuffer[idx + 1] = (sa_ptr->spi & 0x00FF);
-    idx += 2;
+    pTfBuffer[idx] = (uint8_t)(sa_ptr->spi >> 8);
+    idx++;
+    pTfBuffer[idx] = (sa_ptr->spi & 0xFF);
+    idx++;
 
     // Set initialization vector if specified
     status = Crypto_TM_IV_Sanity_Check(&sa_service_type, sa_ptr);
@@ -1784,6 +1785,11 @@ int32_t Crypto_TM_ProcessSecurity(uint8_t *p_ingest, uint16_t len_ingest, uint8_
 
         // Get Key
         status = Crypto_TM_Get_Keys(&ekp, &akp, sa_ptr);
+        if (status != CRYPTO_LIB_SUCCESS)
+        {
+            free(p_new_dec_frame);
+            return status;
+        }
     }
 
     if (status == CRYPTO_LIB_SUCCESS)
@@ -1800,6 +1806,7 @@ int32_t Crypto_TM_ProcessSecurity(uint8_t *p_ingest, uint16_t len_ingest, uint8_
 #ifdef DEBUG
             printf(KRED "Error: SA Not Operational \n" RESET);
 #endif
+            free(p_new_dec_frame);
             return CRYPTO_LIB_ERR_SA_NOT_OPERATIONAL;
         }
 

diff --git a/src/crypto/libgcrypt/cryptography_interface_libgcrypt.template.c b/src/crypto/libgcrypt/cryptography_interface_libgcrypt.template.c
@@ -304,33 +304,32 @@ static int32_t cryptography_validate_authentication(uint8_t *data_out, size_t le
     }
 
 #ifdef MAC_DEBUG
-    uint32_t *tmac_size = &mac_size;
-    uint8_t  *tmac      = calloc(1, *tmac_size);
-    gcry_error          = gcry_mac_read(tmp_mac_hd,
-                                        tmac,               // tag output
-                                        (size_t *)tmac_size // tag size
-             );
-    if ((gcry_error & GPG_ERR_CODE_MASK) != GPG_ERR_NO_ERROR)
-    {
-        printf(KRED "ERROR: gcry_mac_read error code %d\n" RESET, gcry_error & GPG_ERR_CODE_MASK);
-        status = CRYPTO_LIB_ERR_MAC_RETRIEVAL_ERROR;
-        return status;
-    }
-
-    printf("Calculated Mac Size: %d\n", *tmac_size);
-    printf("Calculated MAC (full length):\n\t");
-    for (uint32_t i = 0; i < *tmac_size; i++)
-    {
-        printf("%02X", tmac[i]);
-    }
-    printf("\nCalculated MAC (truncated to sa_ptr->stmacf_len):\n\t");
-    for (uint32_t i = 0; i < mac_size; i++)
-    {
-        printf("%02X", tmac[i]);
-    }
-    printf("\n");
-    if (!tmac)
-        free(tmac);
+    // Commented out due to memory leaks with HMAC
+    // uint32_t *tmac_size = &mac_size;
+    // uint8_t  tmac[*tmac_size];
+    // gcry_error = gcry_mac_read(tmp_mac_hd,
+    //                            &tmac,               // tag output
+    //                            (size_t*)&mac_size // tag size
+    //              );
+    // if ((gcry_error & GPG_ERR_CODE_MASK) != GPG_ERR_NO_ERROR)
+    // {
+    //     printf(KRED "ERROR: gcry_mac_read error code %d\n" RESET, gcry_error & GPG_ERR_CODE_MASK);
+    //     status = CRYPTO_LIB_ERR_MAC_RETRIEVAL_ERROR;
+    //     return status;
+    // }
+
+    // printf("Calculated Mac Size: %d\n", *tmac_size);
+    // printf("Calculated MAC (full length):\n\t");
+    // for (uint32_t i = 0; i < *tmac_size; i++)
+    // {
+    //     printf("%02X", tmac[i]);
+    // }
+    // printf("\nCalculated MAC (truncated to sa_ptr->stmacf_len):\n\t");
+    // for (uint32_t i = 0; i < mac_size; i++)
+    // {
+    //     printf("%02X", tmac[i]);
+    // }
+    // printf("\n");
 
     printf("Received MAC:\n\t");
     for (uint32_t i = 0; i < mac_size; i++)

diff --git a/src/sa/internal/sa_interface_inmemory.template.c b/src/sa/internal/sa_interface_inmemory.template.c
@@ -424,10 +424,10 @@ void sa_populate(void)
     sa[9].ast             = 0;
     sa[9].shivf_len       = 12;
     sa[9].iv_len          = 12;
-    sa[9].shsnf_len       = 2;
+    sa[9].shsnf_len       = 0;
     sa[9].arsnw           = 5;
     sa[9].arsnw_len       = 1;
-    sa[9].arsn_len        = 2;
+    sa[9].arsn_len        = 0;
     sa[9].gvcid_blk.tfvn  = 0x01;
     sa[9].gvcid_blk.scid  = SCID & 0x3FF;
     sa[9].gvcid_blk.vcid  = 0;

diff --git a/support/fuzz/scripts/build-fuzz.sh b/support/fuzz/scripts/build-fuzz.sh
@@ -60,7 +60,8 @@ fi
 echo "🔨 Compiling CryptoLib without ASan..."
 rm -rf build
 mkdir -p build/fuzz && cd build/fuzz
-cmake $PROJECT_ROOT -DCMAKE_C_COMPILER=$CC -DCMAKE_CXX_COMPILER=$CXX \
+cmake $PROJECT_ROOT -B $PROJECT_ROOT/build/fuzz \
+  -DCMAKE_C_COMPILER=$CC -DCMAKE_CXX_COMPILER=$CXX \
   -DCMAKE_C_FLAGS="$OPT_FLAGS" \
   -DCMAKE_CXX_FLAGS="$OPT_FLAGS" \
   -DCMAKE_EXE_LINKER_FLAGS="-flto" \
@@ -77,7 +78,8 @@ cd ..
 echo "🔨 Compiling CryptoLib with ASan..."
 rm -rf fuzz-asan
 mkdir fuzz-asan && cd fuzz-asan
-cmake $PROJECT_ROOT -DCMAKE_C_COMPILER=$CC -DCMAKE_CXX_COMPILER=$CXX \
+cmake $PROJECT_ROOT -B $PROJECT_ROOT/build/fuzz-asan \
+  -DCMAKE_C_COMPILER=$CC -DCMAKE_CXX_COMPILER=$CXX \
   -DCMAKE_C_FLAGS="-fsanitize=address $OPT_FLAGS" \
   -DCMAKE_CXX_FLAGS="-fsanitize=address $OPT_FLAGS" \
   -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address -flto" \
@@ -95,7 +97,8 @@ echo "🔨 Compiling CryptoLib with CmpLog instrumentation..."
 rm -rf fuzz-cmplog
 mkdir fuzz-cmplog && cd fuzz-cmplog
 export AFL_LLVM_CMPLOG=1 # Enable CmpLog instrumentation
-cmake $PROJECT_ROOT -DCMAKE_C_COMPILER=$CC -DCMAKE_CXX_COMPILER=$CXX \
+cmake $PROJECT_ROOT -B $PROJECT_ROOT/build/fuzz-cmplog \
+  -DCMAKE_C_COMPILER=$CC -DCMAKE_CXX_COMPILER=$CXX \
   -DCMAKE_C_FLAGS="$OPT_FLAGS" \
   -DCMAKE_CXX_FLAGS="$OPT_FLAGS" \
   -DCRYPTO_LIBGCRYPT=ON \
@@ -113,7 +116,8 @@ echo "🔨 Compiling CryptoLib with CompCov (laf-intel) instrumentation..."
 rm -rf fuzz-compcov
 mkdir fuzz-compcov && cd fuzz-compcov
 export AFL_LLVM_LAF_ALL=1 # Enable CompCov instrumentation
-cmake $PROJECT_ROOT -DCMAKE_C_COMPILER=$CC -DCMAKE_CXX_COMPILER=$CXX \
+cmake $PROJECT_ROOT -B $PROJECT_ROOT/build/fuzz-compcov \
+  -DCMAKE_C_COMPILER=$CC -DCMAKE_CXX_COMPILER=$CXX \
   -DCMAKE_C_FLAGS="$OPT_FLAGS" \
   -DCMAKE_CXX_FLAGS="$OPT_FLAGS" \
   -DCRYPTO_LIBGCRYPT=ON \

diff --git a/support/fuzz/scripts/fuzz-auto.sh b/support/fuzz/scripts/fuzz-auto.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+cd $SCRIPT_DIR
+./build-fuzz.sh
+cd ..
+python3 generate_corpus.py
+cd ./scripts
+./run-fuzz-multithreaded.sh