Crypto layer: Add missing input validation

Author: lealem47

wolfcrypt/src/dh.c

@@ -1711,6 +1711,9 @@ int wc_DhCheckPubValue(const byte* prime, word32 primeSz, const byte* pub,
     int ret = 0;
     word32 i;
 
+    if (prime == NULL || pub == NULL)
+        return BAD_FUNC_ARG;
+
     for (i = 0; i < pubSz && pub[i] == 0; i++) {
     }
     pubSz -= i;
@@ -1807,9 +1810,8 @@ int wc_DhCheckPrivKey_ex(DhKey* key, const byte* priv, word32 privSz,
 
     if (ret == 0) {
         if (mp_iszero(q) == MP_NO) {
-            /* priv (x) shouldn't be greater than q - 1 */
-            if (mp_copy(&key->q, q) != MP_OKAY)
-                ret = MP_INIT_E;
+            /* priv (x) shouldn't be greater than q - 1.
+               q already set above; don't overwrite with key->q */
             if (ret == 0) {
                 if (mp_sub_d(q, 1, q) != MP_OKAY)
                     ret = MP_SUB_E;

wolfcrypt/src/ecc.c

@@ -10980,8 +10980,14 @@ static int _ecc_import_x963_ex2(const byte* in, word32 inLen, ecc_key* key,
     if (err == MP_OKAY) {
     #ifdef HAVE_COMP_KEY
         /* adjust inLen if compressed */
-        if (compressed)
-            inLen = inLen*2 + 1;  /* used uncompressed len */
+        if (compressed) {
+            /* a compressed coordinate cannot exceed MAX_ECC_BYTES; bound it
+             * before doubling so inLen*2 + 1 cannot overflow word32. */
+            if (inLen > MAX_ECC_BYTES)
+                err = BAD_FUNC_ARG;
+            else
+                inLen = inLen*2 + 1;  /* used uncompressed len */
+        }
     #endif
 
         /* determine key size */

wolfcrypt/src/kdf.c

@@ -87,6 +87,10 @@ int wc_PRF(byte* result, word32 resLen, const byte* secret,
     Hmac   hmac[1];
 #endif
 
+    if ((result == NULL && resLen  != 0) || (secret == NULL && secLen  != 0) ||
+       (seed   == NULL && seedLen != 0))
+      return BAD_FUNC_ARG;
+
     switch (hash) {
     #ifndef NO_MD5
         case md5_mac:
@@ -232,8 +236,11 @@ int wc_PRF_TLSv1(byte* digest, word32 digLen, const byte* secret,
     WC_DECLARE_VAR(sha_result, byte, MAX_PRF_DIG, heap); /* digLen is real size */
     WC_DECLARE_VAR(labelSeed, byte, MAX_PRF_LABSEED, heap);
 
+    /* labLen + seedLen is checked with subtraction to avoid word32 wraparound
+     * (the labLen bound first ensures MAX_PRF_LABSEED - labLen cannot
+     * underflow). */
     if (half > MAX_PRF_HALF ||
-        labLen + seedLen > MAX_PRF_LABSEED ||
+        labLen > MAX_PRF_LABSEED || seedLen > (MAX_PRF_LABSEED - labLen) ||
         digLen > MAX_PRF_DIG)
     {
         return BUFFER_E;
@@ -296,7 +303,9 @@ int wc_PRF_TLS(byte* digest, word32 digLen, const byte* secret, word32 secLen,
     if (useAtLeastSha256) {
         WC_DECLARE_VAR(labelSeed, byte, MAX_PRF_LABSEED, 0);
 
-        if (labLen + seedLen > MAX_PRF_LABSEED) {
+        /* Checked with subtraction to avoid word32 wraparound of
+         * labLen + seedLen. */
+        if (labLen > MAX_PRF_LABSEED || seedLen > (MAX_PRF_LABSEED - labLen)) {
             return BUFFER_E;
         }
 

wolfcrypt/src/rsa.c

@@ -1823,7 +1823,7 @@ static int RsaUnPad_OAEP(byte *pkcsBlock, unsigned int pkcsBlockLen,
     if (ret != 0) {
         ForceZero(tmp, hLen);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(tmp, NULL, DYNAMIC_TYPE_RSA_BUFFER);
+        XFREE(tmp, heap, DYNAMIC_TYPE_RSA_BUFFER);
 #elif defined(WOLFSSL_CHECK_MEM_ZERO)
         wc_MemZero_Check(tmp, hLen);
 #endif
@@ -5410,7 +5410,11 @@ int wc_MakeRsaKey(RsaKey* key, int size, long e, WC_RNG* rng)
         goto out;
     }
 
+#if defined(HAVE_FIPS)
+    if (e < WC_RSA_EXPONENT || (e & 1) == 0) {
+#else
     if (e < 3 || (e & 1) == 0) {
+#endif
         err = BAD_FUNC_ARG;
         goto out;
     }