commit 69a63426afbbedab01a4b7342ebcf1022e0e9b64
author Ronald Cron <ronald.cron@arm.com> Mon Oct 18 09:47:58 2021 +0200
committer Ronald Cron <ronald.cron@arm.com> Fri Dec 03 18:55:33 2021 +0100
tree e9e8701bf9edd1d9b8c58db96035e7305441a44f
parent fcaba24697f826f8aaf948294e7c4a6e8a8df8af

psa: Fix the size of hash buffers

Fix the size of hash buffers for PSA hash
operations.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>

library/psa_crypto.c

diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index e0005cc..088d145 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -2193,7 +2193,7 @@
                               const uint8_t *hash,
                               size_t hash_length )
 {
-    uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
+    uint8_t actual_hash[PSA_HASH_MAX_SIZE];
     size_t actual_hash_length;
     psa_status_t status = psa_hash_finish(
                             operation,
@@ -2236,7 +2236,7 @@
                                const uint8_t *input, size_t input_length,
                                const uint8_t *hash, size_t hash_length )
 {
-    uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
+    uint8_t actual_hash[PSA_HASH_MAX_SIZE];
     size_t actual_hash_length;
 
     if( !PSA_ALG_IS_HASH( alg ) )

library/psa_crypto_mac.c

diff --git a/library/psa_crypto_mac.c b/library/psa_crypto_mac.c
index 19671ec..cf20a9b 100644
--- a/library/psa_crypto_mac.c
+++ b/library/psa_crypto_mac.c
@@ -127,7 +127,7 @@
     uint8_t *mac,
     size_t mac_size )
 {
-    uint8_t tmp[MBEDTLS_MD_MAX_SIZE];
+    uint8_t tmp[PSA_HASH_MAX_SIZE];
     psa_algorithm_t hash_alg = hmac->alg;
     size_t hash_size = 0;
     size_t block_size = PSA_HASH_BLOCK_LENGTH( hash_alg );

library/ssl_cli.c

diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 68d3033..32d4969 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -37,6 +37,7 @@
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
 #include "mbedtls/psa_util.h"
+#include "psa/crypto.h"
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
 #include <string.h>
@@ -3082,7 +3083,11 @@
     if( mbedtls_ssl_ciphersuite_uses_server_signature( ciphersuite_info ) )
     {
         size_t sig_len, hashlen;
-        unsigned char hash[64];
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+        unsigned char hash[PSA_HASH_MAX_SIZE];
+#else
+        unsigned char hash[MBEDTLS_MD_MAX_SIZE];
+#endif
         mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
         mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
         unsigned char *params = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );

library/ssl_srv.c

diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 5e2d152..f34f2de 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -3098,7 +3098,11 @@
     {
         size_t dig_signed_len = ssl->out_msg + ssl->out_msglen - dig_signed;
         size_t hashlen = 0;
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+        unsigned char hash[PSA_HASH_MAX_SIZE];
+#else
         unsigned char hash[MBEDTLS_MD_MAX_SIZE];
+#endif
         int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
         /*

library/ssl_tls.c

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 0d54ae9..5c27692 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -6967,7 +6967,7 @@
         goto exit;
     }
 
-    if( ( status = psa_hash_finish( &hash_operation, hash, MBEDTLS_MD_MAX_SIZE,
+    if( ( status = psa_hash_finish( &hash_operation, hash, PSA_HASH_MAX_SIZE,
                                     hashlen ) ) != PSA_SUCCESS )
     {
          MBEDTLS_SSL_DEBUG_RET( 1, "psa_hash_finish", status );