commit fe724fe618946772c3a7906de945d46dc9354c83
author Paul Elliott <paul.elliott@arm.com> Thu Nov 11 19:00:38 2021 +0000
committer Paul Elliott <paul.elliott@arm.com> Fri Dec 10 17:48:12 2021 +0000
tree dee7171eba923006eb9743b7dc7d80d9ffa130bc
parent 18a59b7d4ca5d896ffe27af8a9ad8c87f7d11ab9

Fix for pkcs12 with NULL or zero length password

Previously passing a NULL or zero length password into either
mbedtls_pkcs12_pbe() or mbedtls_pkcs12_derive() could cause an infinate
loop, and it was also possible to pass a NULL password, with a non-zero
length, which would cause memory corruption.
I have fixed these errors, and improved the documentation to reflect the
changes and further explain what is expected of the inputs.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>

library/pkcs12.c

diff --git a/library/pkcs12.c b/library/pkcs12.c
index 3699dd5..80eb9db 100644
--- a/library/pkcs12.c
+++ b/library/pkcs12.c
@@ -179,6 +179,9 @@
     mbedtls_cipher_context_t cipher_ctx;
     size_t olen = 0;
 
+    if( pwd == NULL && pwdlen != 0 )
+        return( MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA );
+
     cipher_info = mbedtls_cipher_info_from_type( cipher_type );
     if( cipher_info == NULL )
         return( MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE );
@@ -231,13 +234,18 @@
     unsigned char *p = data;
     size_t use_len;
 
-    while( data_len > 0 )
+    if( filler != NULL && fill_len != 0 )
     {
-        use_len = ( data_len > fill_len ) ? fill_len : data_len;
-        memcpy( p, filler, use_len );
-        p += use_len;
-        data_len -= use_len;
+        while( data_len > 0 )
+        {
+            use_len = ( data_len > fill_len ) ? fill_len : data_len;
+            memcpy( p, filler, use_len );
+            p += use_len;
+            data_len -= use_len;
+        }
     }
+    else
+        memset( data, 0, data_len );
 }
 
 int mbedtls_pkcs12_derivation( unsigned char *data, size_t datalen,
@@ -263,6 +271,9 @@
     if( datalen > 128 || pwdlen > 64 || saltlen > 64 )
         return( MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA );
 
+    if( pwd == NULL && pwdlen != 0 )
+        return( MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA );
+
     md_info = mbedtls_md_info_from_type( md_type );
     if( md_info == NULL )
         return( MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE );