narrow ecc_size/sig_size guards to SETKEY||EXPORT_KEY, update _WC_PK_TYPE_MAX, const-qualify export_key.obj, call _ecc_import_x963_ex2 directly, fix GetSetKeyTypeStr, fix NULL deref in wc_RsaPrivateKeyDecode with WOLF_CRYPTO_CB_FIND, add FIND CI config.

Author: night1rider

.github/workflows/os-check.yml

@@ -90,6 +90,7 @@ jobs:
           '--enable-cryptocb --enable-keygen --enable-cryptocbutils=export',
           '--enable-cryptocb --enable-keygen CPPFLAGS="-DWOLF_CRYPTO_CB_EXPORT_KEY"',
           '--enable-cryptocb --enable-keygen --enable-aesgcm --enable-cryptocbutils=setkey,free,export CPPFLAGS="-DWOLF_CRYPTO_CB_AES_SETKEY"',
+          '--enable-cryptocb --enable-keygen --enable-cryptocbutils=setkey,export CPPFLAGS="-DWOLF_CRYPTO_CB_FIND"',
           '--disable-examples CPPFLAGS=-DWOLFSSL_NO_MALLOC',
           'CPPFLAGS=-DNO_WOLFSSL_CLIENT',
           'CPPFLAGS=-DNO_WOLFSSL_SERVER',

wolfcrypt/src/asn.c

@@ -8304,7 +8304,7 @@ int wc_RsaPrivateKeyDecode(const byte* input, word32* inOutIdx, RsaKey* key,
     WC_DECLARE_VAR(tmpKey, RsaKey, 1, NULL);
 #endif
 
-    if (key == NULL) {
+    if (key == NULL || input == NULL || inOutIdx == NULL) {
         return BAD_FUNC_ARG;
     }
 

wolfcrypt/src/cryptocb.c

@@ -118,14 +118,16 @@ static const char* GetAlgoTypeStr(int algo)
 static const char* GetSetKeyTypeStr(int type)
 {
     switch (type) {
+        case WC_SETKEY_NONE:      return "None";
         case WC_SETKEY_HMAC:      return "HMAC";
         case WC_SETKEY_RSA_PUB:   return "RSA-Pub";
         case WC_SETKEY_RSA_PRIV:  return "RSA-Priv";
         case WC_SETKEY_ECC_PUB:   return "ECC-Pub";
         case WC_SETKEY_ECC_PRIV:  return "ECC-Priv";
         case WC_SETKEY_AES:       return "AES";
+        default:                  break;
     }
-    return "Unknown";
+    return NULL;
 }
 #endif /* WOLF_CRYPTO_CB_SETKEY */
 static const char* GetPkTypeStr(int pk)
@@ -2301,7 +2303,7 @@ int wc_CryptoCb_SetKey(int devId, int type, void* obj,
  * uses normal software export functions on 'out' and frees it.
  * Returns: 0 on success, CRYPTOCB_UNAVAILABLE if not handled, negative on error
  */
-int wc_CryptoCb_ExportKey(int devId, int type, void* obj, void* out)
+int wc_CryptoCb_ExportKey(int devId, int type, const void* obj, void* out)
 {
     int ret = WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE);
     CryptoCb* dev;

wolfcrypt/src/ecc.c

@@ -9997,7 +9997,7 @@ int wc_ecc_export_x963(ecc_key* key, byte* out, word32* outLen)
         }
 
         ret = wc_CryptoCb_ExportKey(key->devId, WC_PK_TYPE_ECDSA_SIGN,
-                                     (void*)key, tmpKey);
+                                     key, tmpKey);
         if (ret == 0) {
             /* Call software helper (no callback recursion) */
             ret = _ecc_export_x963(tmpKey, out, outLen);
@@ -11326,7 +11326,7 @@ int wc_ecc_export_ex(ecc_key* key, byte* qx, word32* qxLen,
         }
 
         err = wc_CryptoCb_ExportKey(key->devId, WC_PK_TYPE_ECDSA_SIGN,
-                                     (void*)key, tmpKey);
+                                     key, tmpKey);
         if (err == 0) {
             /* Call software helper (no callback recursion) */
             err = _ecc_export_ex(tmpKey, qx, qxLen, qy, qyLen, d, dLen,
@@ -11412,7 +11412,7 @@ static int _ecc_import_private_key_ex(const byte* priv, word32 privSz,
     if (pub != NULL) {
     #ifndef NO_ASN
         word32 idx = 0;
-        ret = wc_ecc_import_x963_ex(pub, pubSz, key, curve_id);
+        ret = _ecc_import_x963_ex2(pub, pubSz, key, curve_id, 0);
         if (ret < 0)
             ret = wc_EccPublicKeyDecode(pub, &idx, key, pubSz);
         key->type = ECC_PRIVATEKEY;
@@ -12250,7 +12250,8 @@ int wc_ecc_size(ecc_key* key)
         return 0;
     }
 
-#ifdef WOLF_CRYPTO_CB
+#if defined(WOLF_CRYPTO_CB) && \
+    (defined(WOLF_CRYPTO_CB_SETKEY) || defined(WOLF_CRYPTO_CB_EXPORT_KEY))
     if (key->devId != INVALID_DEVID) {
         int ret;
         int keySz = 0;
@@ -12301,7 +12302,8 @@ int wc_ecc_sig_size(const ecc_key* key)
         return 0;
     }
 
-#ifdef WOLF_CRYPTO_CB
+#if defined(WOLF_CRYPTO_CB) && \
+    (defined(WOLF_CRYPTO_CB_SETKEY) || defined(WOLF_CRYPTO_CB_EXPORT_KEY))
     if (key->devId != INVALID_DEVID) {
         int ret;
         int cbKeySz = 0;

wolfcrypt/src/rsa.c

@@ -4531,7 +4531,7 @@ int wc_RsaFlattenPublicKey(const RsaKey* key, byte* e, word32* eSz, byte* n,
         }
 
         ret = wc_CryptoCb_ExportKey(key->devId, WC_PK_TYPE_RSA,
-                                     (void*)key, tmpKey);
+                                     key, tmpKey);
         if (ret == 0) {
             /* Call software helper (no callback recursion) */
             ret = _RsaFlattenPublicKey(tmpKey, e, eSz, n, nSz);
@@ -4654,7 +4654,7 @@ int wc_RsaExportKey(const RsaKey* key,
             }
 
             ret = wc_CryptoCb_ExportKey(key->devId, WC_PK_TYPE_RSA,
-                                         (void*)key, tmpKey);
+                                         key, tmpKey);
             if (ret == 0) {
                 /* Call software helper (no callback recursion) */
                 ret = _RsaExportKey(tmpKey, e, eSz, n, nSz,

wolfssl/wolfcrypt/cryptocb.h

@@ -526,7 +526,7 @@ typedef struct wc_CryptoInfo {
 #ifdef WOLF_CRYPTO_CB_EXPORT_KEY
     struct {                    /* uses wc_AlgoType=WC_ALGO_TYPE_EXPORT_KEY */
         int type;               /* enum wc_PkType (WC_PK_TYPE_RSA, etc.) */
-        void* obj;              /* Hardware key (has devCtx/id[]) */
+        const void* obj;        /* Hardware key (has devCtx/id[]) */
         void* out;              /* Software key to fill (same type as obj) */
     } export_key;
 #endif /* WOLF_CRYPTO_CB_EXPORT_KEY */
@@ -821,7 +821,7 @@ WOLFSSL_LOCAL int wc_CryptoCb_SetKey(int devId, int type, void* obj,
 #endif /* WOLF_CRYPTO_CB_SETKEY */
 #ifdef WOLF_CRYPTO_CB_EXPORT_KEY
 WOLFSSL_LOCAL int wc_CryptoCb_ExportKey(int devId, int type,
-                                         void* obj, void* out);
+                                         const void* obj, void* out);
 #endif /* WOLF_CRYPTO_CB_EXPORT_KEY */
 
 #endif /* WOLF_CRYPTO_CB */

wolfssl/wolfcrypt/types.h

@@ -1570,6 +1570,8 @@ enum wc_PkType {
     WC_PK_TYPE_RSA_OAEP = 27,
     WC_PK_TYPE_EC_GET_SIZE = 28,
     WC_PK_TYPE_EC_GET_SIG_SIZE = 29,
+    #undef _WC_PK_TYPE_MAX
+    #define _WC_PK_TYPE_MAX WC_PK_TYPE_EC_GET_SIG_SIZE
     WC_PK_TYPE_MAX = _WC_PK_TYPE_MAX
 };