commit f9c91a7fb5766cdb5b85a6dc3292c155e8309c26
author Paul Elliott <paul.elliott@arm.com> Sun Feb 05 18:06:38 2023 +0000
committer Paul Elliott <paul.elliott@arm.com> Wed Feb 15 23:34:29 2023 +0000
tree 49898140034cd0cabbeeda36b6be2b26fb51270d
parent 0e9d6bd3f8041e86a77d3b592bc730e18ca37f93

Store the hash, rather than the pointer

For sign and verify, the pointer passed in to the hash is not guaranteed to
remain valid inbetween calls, thus we need to store the hash in the
operation. Added a test to ensure this is the case.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>

library/psa_crypto.c

diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index 93b4045..a3bc806 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -3516,7 +3516,13 @@
     operation->md_alg = mbedtls_hash_info_md_from_psa(hash_alg);
     operation->alg = alg;
 
-    operation->hash = hash;
+    operation->hash = mbedtls_calloc(1, hash_length);
+
+    if (operation->hash == NULL) {
+        return PSA_ERROR_INSUFFICIENT_MEMORY;
+    }
+
+    memcpy(operation->hash, hash, hash_length);
     operation->hash_length = hash_length;
 
     return PSA_SUCCESS;
@@ -3643,8 +3649,12 @@
     if (operation->ctx) {
         mbedtls_ecdsa_free(operation->ctx);
         mbedtls_free(operation->ctx);
+        operation->ctx = NULL;
     }
 
+    mbedtls_free(operation->hash);
+    operation->hash = NULL;
+
     mbedtls_ecdsa_restart_free(&operation->restart_ctx);
 
     return PSA_SUCCESS;
@@ -3743,7 +3753,13 @@
 
     mbedtls_ecdsa_restart_init(&operation->restart_ctx);
 
-    operation->hash = hash;
+    operation->hash = mbedtls_calloc(1, hash_length);
+
+    if (operation->hash == NULL) {
+        return PSA_ERROR_INSUFFICIENT_MEMORY;
+    }
+
+    memcpy(operation->hash, hash, hash_length);
     operation->hash_length = hash_length;
 
     return PSA_SUCCESS;
@@ -3802,8 +3818,12 @@
     if (operation->ctx) {
         mbedtls_ecdsa_free(operation->ctx);
         mbedtls_free(operation->ctx);
+        operation->ctx = NULL;
     }
 
+    mbedtls_free(operation->hash);
+    operation->hash = NULL;
+
     mbedtls_ecdsa_restart_free(&operation->restart_ctx);
 
     mbedtls_mpi_free(&operation->r);

library/psa_crypto_core.h

diff --git a/library/psa_crypto_core.h b/library/psa_crypto_core.h
index 610d780..f74db70 100644
--- a/library/psa_crypto_core.h
+++ b/library/psa_crypto_core.h
@@ -711,7 +711,8 @@
  * \retval #PSA_ERROR_NOT_SUPPORTED Either no internal interruptible operations
  *         are currently supported, or the key type is currently unsupported.
  * \retval #PSA_ERROR_INSUFFICIENT_MEMORY
- *         There was insufficient memory to load the key representation.
+ *         There was insufficient memory either to load the key representation,
+ *         or to store the hash.
  */
 psa_status_t mbedtls_psa_sign_hash_start(
     mbedtls_psa_sign_hash_interruptible_operation_t *operation,
@@ -815,7 +816,8 @@
  *        Either no internal interruptible operations are currently supported,
  *         or the key type is currently unsupported.
  * \retval #PSA_ERROR_INSUFFICIENT_MEMORY
- *        There was insufficient memory to load the key representation.
+ *        There was insufficient memory either to load the key representation,
+ *        or to store the hash.
  */
 psa_status_t mbedtls_psa_verify_hash_start(
     mbedtls_psa_verify_hash_interruptible_operation_t *operation,