This splits UB+ASAN-Werror.Fedora.x86_64.gcc into build and test
phases and make it simpler by:
- Stop doing 2 builds for trust store, given the same code path is
exercised when the trust store is enabled at build time
- Stop doing 2 builds for AGGRESSIVE_REALLOC, now that the buffer
allocation strategy can be tuned with the GNUTLS_BUFFER_RECLAIM
envvar
- Remove -Werror check from this pipeline, as it has nothing to do
with sanitizers
handshake: clear HSK_PSK_SELECTED is when resetting binders
When a TLS 1.3 handshake involves HRR and resumption or PSK, and the
second Client Hello omits PSK, the server would result in a NULL
pointer dereference as the PSK binder information is cleared while the
HSK_PSK_SELECTED flag is still set. This makes sure that
HSK_PSK_SELECTED flag is always cleared when the PSK binders are
reset. This also makes it clear the HSK_PSK_SELECTED flag is valid
only during a handshake; after that, whether PSK is used can be
checked with gnutls_auth_client_get_type.
certtool: avoid 1-byte write buffer overrun when parsing template
Previously, when parsing a template file with a number of key value
pairs, certtool could write a NUL byte after the heap buffer, causing
a memory corruption. This fixes the issue by allocating the NUL byte.
Reported by David Aitel.
x509: avoid double free when exporting othernames in SAN
Previously, the _gnutls_write_new_othername function, called by
gnutls_x509_ext_export_subject_alt_names to export "otherName" in a
certificate's SAN extension, freed the caller allocated ASN.1
structure upon error, resulting in a potential double-free.
Andrew Hamilton [Mon, 7 Jul 2025 01:35:54 +0000 (10:35 +0900)]
x509: reject zero-length version in certificate request
Ensure zero size asn1 values are considered invalid in
gnutls_x509_crq_get_version, this ensures crq version is not used
uninitialized. Spotted by oss-fuzz at:
https://issues.oss-fuzz.com/issues/42536706
Signed-off-by: Andrew Hamilton <adhamilt@gmail.com> Signed-off-by: Daiki Ueno <ueno@gnu.org>
Andrew Hamilton [Mon, 7 Jul 2025 01:31:55 +0000 (10:31 +0900)]
psk: fix read buffer overrun in the "pre_shared_key" extension
While processing the "pre_shared_key" extension in TLS 1.3, if there
are certain malformed data in the extension headers, then the code may
read uninitialized memory (2 bytes) beyond the received TLS extension
buffer. Spotted by oss-fuzz at:
https://issues.oss-fuzz.com/issues/42513990
Signed-off-by: Andrew Hamilton <adhamilt@gmail.com> Signed-off-by: Daiki Ueno <ueno@gnu.org>
Andrew Hamilton [Mon, 7 Jul 2025 01:23:59 +0000 (10:23 +0900)]
x509: fix read buffer overrun in SCT timestamps
Prevent reading beyond heap buffer in call to _gnutls_parse_ct_sct
when processing x509 Signed Certificate Timestamps with certain
malformed data. Spotted by oss-fuzz at:
https://issues.oss-fuzz.com/issues/42530513
Signed-off-by: Andrew Hamilton <adhamilt@gmail.com> Signed-off-by: Daiki Ueno <ueno@gnu.org>
As libminitasn1.la is always built a static library, linking it twice
makes linking fail because of duplicated symbols. This also stops
including <nettle/bignum.h> as it is unused and causing compile error
on macOS homebrew:
In file included from p11_pk.c:32:
/opt/homebrew/Cellar/nettle/3.10.2/include/nettle/bignum.h:50:11: fatal error: 'gmp.h' file not found
# include <gmp.h>
^~~~~~~
1 error generated.
x509: support encoding of ML-DSA private keys in CHOICE format
This enables to encode a generaeted ML-DSA private key in the three
formats defined in draft-ietf-lamps-dilithium-certificates-12,
indicated with the gnutls_pkcs_encrypt_flags_t enum as
GNUTLS_PKCS_MLDSA_SEED and/or GNUTLS_PKCS_MLDSA_EXPANDED values. The
default format ML-DSA keys has been changed to the "both" format.
algorithms: assign hash strength to ML-DSA signature algorithms
The _gnutls_sign_get_hash_strength function previously returned 0 for
ML-DSA algorithms, preventing the security level check in certificate
signatures. This assigns the collision strength for commitment hashes,
as defined in FIPS 204, section 4, table 1.
x509: support decoding of ML-DSA private keys in CHOICE format
This extends the acceptable formats of ML-DSA private keys to the
three formats defined in draft-ietf-lamps-dilithium-certificates-12,
section 6, namely: "seed", "expandedKey", and "both". The legacy
format compatible with liboqs/oqsprovider is still accepted and the
default output format for now.
doc: fix typo in docs about system profile fallback
Docs for the system profile fallback syntax accidentally repeated
the "@" marker before each keyword. The "@" marker only indicates
the start of the profile field, and individual names are merely
separated by a comma, per the impl in 6b6d9dd44e.
Jiasheng Jiang [Mon, 16 Jun 2025 05:24:14 +0000 (05:24 +0000)]
lib/accelerated/x86/hmac-padlock.c: Add gnutls_free() to avoid memory leak
Add gnutls_free() to free ctx if _hmac_ctx_init() fails to avoid memory leak.
Fixes: 38a089b67 ("Updates for padlock hashes in C7 nano. Requires a part of nettle to be included.") Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Jiasheng Jiang [Mon, 16 Jun 2025 05:22:53 +0000 (05:22 +0000)]
lib/accelerated/x86/sha-padlock.c: Free ctx on error to avoid memory leak
Call gnutls_free() to release ctx if _ctx_init() fails, preventing a memory leak.
Fixes: 38a089b67 ("Updates for padlock hashes in C7 nano. Requires a part of nettle to be included.") Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Jiasheng Jiang [Mon, 16 Jun 2025 05:21:09 +0000 (05:21 +0000)]
lib/pk.c: Free tmp_output on error to avoid memory leak
Call gnutls_free() to release tmp_output if asn1_der_coding() fails, preventing memory leak.
Fixes: 6f9bfaac9 ("Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures.") Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
To minimize the number of dependencies on Gnulib, this migrates the
uses of the "hash" module to gl_linkedhash_list, which we extensively
use as a generic hash-table.
kTLS now returns -EKEYEXPIRED when the socket's keys aren't updated after
receiving a keyupdate (this is very unlikely). Currently when this
happens the ktls recv funtion returns GNUTLS_E_AGAIN and the receive
function is called again and again.
projects / thirdparty / gnutls.git / log
