From 47b2fefb03122e49375a252698c857e477c8cf35 Mon Sep 17 00:00:00 2001 From: Nicky Mouha Date: Wed, 17 May 2023 18:07:00 -0400 Subject: [PATCH 1/2] Update hkdf.c to avoid potentially vulnerable code pattern. Change-Id: I190fcdb0b9667b0ac6f490b36edc63237af7fffb Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/59905 Reviewed-by: David Benjamin --- crypto/fipsmodule/hkdf/hkdf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/fipsmodule/hkdf/hkdf.c b/crypto/fipsmodule/hkdf/hkdf.c index fa1cc7244..c2ebce824 100644 --- a/crypto/fipsmodule/hkdf/hkdf.c +++ b/crypto/fipsmodule/hkdf/hkdf.c @@ -94,7 +94,7 @@ int HKDF_expand(uint8_t *out_key, size_t out_len, const EVP_MD *digest, } todo = digest_len; - if (done + todo > out_len) { + if (todo > out_len - done) { todo = out_len - done; } OPENSSL_memcpy(out_key + done, previous, todo); From 74a75b39596757546c1070f3dc5184bbab44397b Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Thu, 18 May 2023 19:20:27 -0400 Subject: [PATCH 2/2] Add a comment about the Chromium sandbox for macOS sysctls https://crrev.com/c/4415225 had to react to us querying these. Add a comment so we can fix this proactively in the future. Bug: chromium:1432323 Change-Id: I2ffe4d90e32215b521815a25f3448502da2156bf Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/59925 Reviewed-by: Adam Langley --- SANDBOXING.md | 6 ++++-- crypto/cpu_aarch64_apple.c | 3 +++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/SANDBOXING.md b/SANDBOXING.md index b1a32df51..cb17720be 100644 --- a/SANDBOXING.md +++ b/SANDBOXING.md @@ -90,8 +90,10 @@ addition to the operations above. On Linux ARM platforms, BoringSSL depends on OS APIs to query CPU capabilities. 32-bit and 64-bit ARM both depend on the `getauxval` function. 32-bit ARM, to -work around bugs in older Android devices, may additionally read `/proc/cpuinfo` -and `/proc/self/auxv`. +work around bugs in older Android devices, may additionally read +`/proc/cpuinfo`. + +On 64-bit Apple ARM platforms, BoringSSL needs to query `hw.optional.*` sysctls. If querying CPU capabilities fails, BoringSSL will still function, but may not perform as well. diff --git a/crypto/cpu_aarch64_apple.c b/crypto/cpu_aarch64_apple.c index f6c71730e..de6a8bd0a 100644 --- a/crypto/cpu_aarch64_apple.c +++ b/crypto/cpu_aarch64_apple.c @@ -65,6 +65,9 @@ void OPENSSL_cpuid_setup(void) { // available in macOS 12. For compatibility with macOS 11, we also support // the old names. The old names don't have values for features like FEAT_AES, // so instead we detect them statically above. + // + // If querying new sysctls, update the Chromium sandbox definition. See + // https://crrev.com/c/4415225. if (has_hw_feature("hw.optional.arm.FEAT_SHA512") || has_hw_feature("hw.optional.armv8_2_sha512")) { OPENSSL_armcap_P |= ARMV8_SHA512;