crypt/wolfssl
1
0
Fork 0
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-10-24 04:09:07 +03:00
Code Activity

sha256: stage unaligned hash in wc_Sha256HashBlock MOVBE fallback

Browse Source 
Gating the MOVBE store block behind CPUID made the C fallback reachable
on x86_64 CPUs without MOVBE. With WOLFSSL_AESNI, WOLFSSL_GENERAL_ALIGNMENT
is 16, so the alignment staging guarded by WOLFSSL_GENERAL_ALIGNMENT < 4 was
compiled out, leaving unaligned word32 stores to the caller's hash buffer
(LMS passes buffer + 23 in wc_hss_derive_seed_i). Make the staging
unconditional so the reversed digest is copied byte-wise into an unaligned
hash. Addresses Fenrir review on PR #11340.
This commit is contained in:
Sameeh Jubran
2026-09-04 16:55:14 +03:00
committed by JacobBarthelmeh
parent 977d8c5c48
commit 588f036e98
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
wolfcrypt/src/sha256.c
View File

@@ -2487,9 +2487,13 @@ static WC_INLINE int Transform_Sha256_Len(wc_Sha256* sha256, const byte* data,
else
#endif
{
/* C fallback, now reachable on x86_64 when the CPU has
* no MOVBE. LMS passes an unaligned interior pointer as
* hash, so the alignment staging must be unconditional:
* WOLFSSL_GENERAL_ALIGNMENT >= 4 does not imply hash is
* aligned here. */
word32* hash32 = (word32*)hash;
word32* digest = (word32*)sha256->digest;
#if WOLFSSL_GENERAL_ALIGNMENT < 4
ALIGN16 word32 buf[WC_SHA256_DIGEST_SIZE / sizeof(word32)];
if (((size_t)digest & 0x3) != 0) {
@@ -2506,14 +2510,11 @@ static WC_INLINE int Transform_Sha256_Len(wc_Sha256* sha256, const byte* data,
else if (((size_t)hash32 & 0x3) != 0) {
hash32 = digest;
}
#endif
ByteReverseWords(hash32, digest,
(word32)(sizeof(word32) * 8));
#if WOLFSSL_GENERAL_ALIGNMENT < 4
if (hash != (byte*)hash32) {
XMEMCPY(hash, hash32, WC_SHA256_DIGEST_SIZE);
}
#endif
}
}
sha256->digest[0] = 0x6A09E667L;