Stricter validation of nettle_cipher and nettle_hash in tests.

Increase NETTLE_MAX_HASH_BLOCK_SIZE to 144, to accommodate sha3_224.

diff --git a/ChangeLog b/ChangeLog
index 72ac98f23a6d167a56c70f887163562aa243c2da..93da48563f39861996835de8d42b53dbc8273832 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
 2022-09-28  Niels Möller  <nisse@lysator.liu.se>
 
+       * testsuite/meta-hash-test.c (test_main): Add check of
+       NETTLE_MAX_HASH_BLOCK_SIZE.
+       * nettle-internal.h (NETTLE_MAX_HASH_BLOCK_SIZE): Increase to 144,
+       to accommodate sha3_224.
+       * testsuite/meta-cipher-test.c (test_main): Check that cipher
+       metadata doesn't exceed NETTLE_MAX_CIPHER_BLOCK_SIZE or
+       NETTLE_MAX_CIPHER_KEY_SIZE.
+
        From Daiki Ueno:
        * siv-gcm.c (siv_gcm_encrypt_message, siv_gcm_decrypt_message):
        New file, implementation of SIV-GCM.

diff --git a/nettle-internal.h b/nettle-internal.h
index b7726d68ace0a61762570cef480d1db6350ee18f..bf906c88b215fde6e6c1ec9b6e4ee3aac89cd715 100644 (file)
--- a/nettle-internal.h
+++ b/nettle-internal.h
@@ -74,8 +74,8 @@
   do { assert((size_t)(size) <= (sizeof(name))); } while (0)
 #endif 
 
-/* Arbitrary limits which apply to systems that don't have alloca */
-#define NETTLE_MAX_HASH_BLOCK_SIZE 128
+/* Limits that apply to systems that don't have alloca */
+#define NETTLE_MAX_HASH_BLOCK_SIZE 144  /* For sha3_224*/
 #define NETTLE_MAX_HASH_DIGEST_SIZE 64
 #define NETTLE_MAX_HASH_CONTEXT_SIZE (sizeof(struct sha3_224_ctx))
 #define NETTLE_MAX_SEXP_ASSOC 17

diff --git a/testsuite/meta-cipher-test.c b/testsuite/meta-cipher-test.c
index 62488b7f2787de1598858e9a9f3538ab42766185..912fac5ad900634ddcb9decdc148faec9acfbd66 100644 (file)
--- a/testsuite/meta-cipher-test.c
+++ b/testsuite/meta-cipher-test.c
@@ -1,5 +1,6 @@
 #include "testutils.h"
 #include "nettle-meta.h"
+#include "nettle-internal.h"
 
 const char* ciphers[] = {
   "aes128",
@@ -35,8 +36,11 @@ test_main(void)
     ASSERT(NULL != nettle_ciphers[j]); /* make sure we found a matching cipher */
   }
   j = 0;
-  while (NULL != nettle_ciphers[j])
-    j++;
+  for (j = 0; NULL != nettle_ciphers[j]; j++)
+    {
+      ASSERT(nettle_ciphers[j]->block_size <= NETTLE_MAX_CIPHER_BLOCK_SIZE);
+      ASSERT(nettle_ciphers[j]->key_size <= NETTLE_MAX_CIPHER_KEY_SIZE);
+    }
   ASSERT(j == count); /* we are not missing testing any ciphers */
 }
   

diff --git a/testsuite/meta-hash-test.c b/testsuite/meta-hash-test.c
index 3aed43fc46275b613c875da9cd47dbc6ef9d20a4..6a15e7db630d5b81016ceb0085c03c0953653797 100644 (file)
--- a/testsuite/meta-hash-test.c
+++ b/testsuite/meta-hash-test.c
@@ -36,6 +36,7 @@ test_main(void)
   }
 
   for (i = 0; NULL != nettle_hashes[i]; i++) {
+    ASSERT(nettle_hashes[i]->block_size <= NETTLE_MAX_HASH_BLOCK_SIZE);
     ASSERT(nettle_hashes[i]->digest_size <= NETTLE_MAX_HASH_DIGEST_SIZE);
     ASSERT(nettle_hashes[i]->context_size <= NETTLE_MAX_HASH_CONTEXT_SIZE);
   }