Merge pull request #10833 from kareem-wolfssl/zd22079

Add some missing PKCS7 length checks and bound DTLS 1.3 ACK list.

Author: dgarske

src/dtls13.c

@@ -2822,14 +2822,30 @@ int Dtls13DoScheduledWork(WOLFSSL* ssl)
          * shared WriteDup struct so the write side sends the ACK instead. */
         if (ssl->dupWrite != NULL && ssl->dupSide == READ_DUP_SIDE) {
             struct Dtls13RecordNumber** tail = NULL;
+            int count = 0;
             if (wc_LockMutex(&ssl->dupWrite->dupMutex) != 0)
                 return BAD_MUTEX_E;
+            /* Walk to the tail, counting what is already queued. */
             tail = (struct Dtls13RecordNumber**)&ssl->dupWrite->sendAckList;
-            while (*tail != NULL)
+            while (*tail != NULL) {
                 tail = &(*tail)->next;
-            *tail = ssl->dtls13Rtx.seenRecords;
-            ssl->dtls13Rtx.seenRecords = NULL;
-            ssl->dtls13Rtx.seenRecordsCount = 0;
+                count++;
+            }
+            /* Each transferred batch is already capped at
+             * DTLS13_ACK_MAX_RECORDS. Only splice a new batch while the queue
+             * is below the cap so repeated scheduled-work cycles cannot grow
+             * it without bound (aggregate stays under 2 *
+             * DTLS13_ACK_MAX_RECORDS). Otherwise drop the batch: ACKs are
+             * best-effort and the peer retransmits if one is lost. */
+            if (count < DTLS13_ACK_MAX_RECORDS) {
+                *tail = ssl->dtls13Rtx.seenRecords;
+                ssl->dtls13Rtx.seenRecords = NULL;
+                ssl->dtls13Rtx.seenRecordsCount = 0;
+            }
+            else {
+                /* Queue already at the cap: drop this batch. */
+                Dtls13RtxFlushAcks(ssl);
+            }
             ssl->dupWrite->sendAcks = 1;
             wc_UnLockMutex(&ssl->dupWrite->dupMutex);
         }

wolfcrypt/src/pkcs7.c

@@ -13645,6 +13645,12 @@ int wc_PKCS7_DecodeEnvelopedData(wc_PKCS7* pkcs7, byte* in,
                 break;
             }
         #else
+            /* ensure IV bytes are within the input buffer before copying */
+            if (length < 0 || (word32)length > pkiMsgSz ||
+                    idx > pkiMsgSz - (word32)length) {
+                ret = BUFFER_E;
+                break;
+            }
             ret = 0;
         #endif
 
@@ -15292,6 +15298,9 @@ int wc_PKCS7_DecodeAuthEnvelopedData(wc_PKCS7* pkcs7, byte* in,
         #endif
 
             /* Get authTag OCTET STRING */
+            if (ret == 0 && localIdx >= pkiMsgSz) {
+                ret = BUFFER_E;
+            }
             if (ret == 0 && pkiMsg[localIdx] != ASN_OCTET_STRING) {
                 ret = ASN_PARSE_E;
             }
@@ -15358,6 +15367,17 @@ int wc_PKCS7_DecodeAuthEnvelopedData(wc_PKCS7* pkcs7, byte* in,
                 ret = ASN_PARSE_E;
             }
 
+        #ifdef NO_PKCS7_STREAM
+            /* In the streaming build the block above re-buffers enough data for
+             * the auth tag. Without streaming, verify the tag fits within the
+             * provided input before copying. */
+            if (ret == 0 &&
+                    (idx > pkiMsgSz || authTagSz > pkiMsgSz - idx)) {
+                WOLFSSL_MSG("AuthEnvelopedData authTag exceeds input buffer");
+                ret = BUFFER_E;
+            }
+        #endif
+
             if (ret == 0) {
                 XMEMCPY(authTag, &pkiMsg[idx], authTagSz);
                 idx += authTagSz;