From 31a4ba72646de34d26923e2293a1ea08f52e9f7f Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 17 Jun 2019 15:01:08 +0200 Subject: [PATCH 1/3] Fix misuse of signed ints in the HAVEGE module The elements of the HAVEGE state are manipulated with bitwise operations, with the expectations that the elements are 32-bit unsigned integers (or larger). But they are declared as int, and so the code has undefined behavior. Clang with Asan correctly points out some shifts that reach the sign bit. Use unsigned int internally. This is technically an aliasing violation since we're accessing an array of `int` via a pointer to `unsigned int`, but since we don't access the array directly inside the same function, it's very unlikely to be compiled in an unintended manner. --- library/havege.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/library/havege.c b/library/havege.c index 54f897c6e..08f9d974d 100644 --- a/library/havege.c +++ b/library/havege.c @@ -54,7 +54,7 @@ * ------------------------------------------------------------------------ */ -#define SWAP(X,Y) { int *T = (X); (X) = (Y); (Y) = T; } +#define SWAP(X,Y) { unsigned *T = (X); (X) = (Y); (Y) = T; } #define TST1_ENTER if( PTEST & 1 ) { PTEST ^= 3; PTEST >>= 1; #define TST2_ENTER if( PTEST & 1 ) { PTEST ^= 3; PTEST >>= 1; @@ -77,7 +77,7 @@ PTX = (PT1 >> 18) & 7; \ PT1 &= 0x1FFF; \ PT2 &= 0x1FFF; \ - CLK = (int) mbedtls_timing_hardclock(); \ + CLK = (unsigned) mbedtls_timing_hardclock(); \ \ i = 0; \ A = &WALK[PT1 ]; RES[i++] ^= *A; \ @@ -100,7 +100,7 @@ \ IN = (*A >> (5)) ^ (*A << (27)) ^ CLK; \ *A = (*B >> (6)) ^ (*B << (26)) ^ CLK; \ - *B = IN; CLK = (int) mbedtls_timing_hardclock(); \ + *B = IN; CLK = (unsigned) mbedtls_timing_hardclock(); \ *C = (*C >> (7)) ^ (*C << (25)) ^ CLK; \ *D = (*D >> (8)) ^ (*D << (24)) ^ CLK; \ \ @@ -151,19 +151,20 @@ PT1 ^= (PT2 ^ 0x10) & 0x10; \ \ for( n++, i = 0; i < 16; i++ ) \ - hs->pool[n % MBEDTLS_HAVEGE_COLLECT_SIZE] ^= RES[i]; + POOL[n % MBEDTLS_HAVEGE_COLLECT_SIZE] ^= RES[i]; /* * Entropy gathering function */ static void havege_fill( mbedtls_havege_state *hs ) { - int i, n = 0; - int U1, U2, *A, *B, *C, *D; - int PT1, PT2, *WALK, RES[16]; - int PTX, PTY, CLK, PTEST, IN; + unsigned i, n = 0; + unsigned U1, U2, *A, *B, *C, *D; + unsigned PT1, PT2, *WALK, *POOL, RES[16]; + unsigned PTX, PTY, CLK, PTEST, IN; - WALK = hs->WALK; + WALK = (unsigned *) hs->WALK; + POOL = (unsigned *) hs->pool; PT1 = hs->PT1; PT2 = hs->PT2; From 04659a023ef8ffefffd0aab273a396b5d876ebf6 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 17 Jun 2019 15:12:51 +0200 Subject: [PATCH 2/3] Prevent building the HAVEGE module on platforms where it doesn't work If int is not capable of storing as many values as unsigned, the code may generate a trap value. If signed int and unsigned int aren't 32-bit types, the code may calculate meaningless values. --- library/havege.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/library/havege.c b/library/havege.c index 08f9d974d..c139e1db0 100644 --- a/library/havege.c +++ b/library/havege.c @@ -38,8 +38,19 @@ #include "mbedtls/timing.h" #include "mbedtls/platform_util.h" +#include #include +/* If int isn't capable of storing 2^32 distinct values, the code of this + * module may cause a processor trap or a miscalculation. If int is more + * than 32 bits, the code may not calculate the intended values. */ +#if INT_MIN + 1 != -0x7fffffff +#error "The HAVEGE module requires int to be exactly 32 bits, with INT_MIN = -2^31." +#endif +#if UINT_MAX != 0xffffffff +#error "The HAVEGE module requires unsigned to be exactly 32 bits." +#endif + /* ------------------------------------------------------------------------ * On average, one iteration accesses two 8-word blocks in the havege WALK * table, and generates 16 words in the RES array. From e43e3addbbc7dc39e798f2b49d5ab4bb454f61ba Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 17 Jun 2019 15:15:40 +0200 Subject: [PATCH 3/3] Changelog entry for HAVEGE fix --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index cec77d2af..ae78455d4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -46,6 +46,7 @@ Bugfix * Fix multiple X.509 functions previously returning ASN.1 low-level error codes to always wrap these codes into X.509 high level error codes before returning. Fixes #2431. + * Fix misuse of signed arithmetic in the HAVEGE module. #2598 Changes * Return from various debugging routines immediately if the