diff options
Diffstat (limited to 'nx_secure/src/nx_secure_generate_client_key_exchange.c')
| -rw-r--r-- | nx_secure/src/nx_secure_generate_client_key_exchange.c | 46 |
1 files changed, 36 insertions, 10 deletions
diff --git a/nx_secure/src/nx_secure_generate_client_key_exchange.c b/nx_secure/src/nx_secure_generate_client_key_exchange.c index 0af26746..694694e4 100644 --- a/nx_secure/src/nx_secure_generate_client_key_exchange.c +++ b/nx_secure/src/nx_secure_generate_client_key_exchange.c @@ -9,6 +9,8 @@ * SPDX-License-Identifier: MIT **************************************************************************/ +// Some portions generated by Codex gpt-5.5. + /**************************************************************************/ /**************************************************************************/ @@ -124,15 +126,40 @@ NX_CRYPTO_EXTENDED_OUTPUT extended_output; { data_size = (UINT)(1 + tls_key_material -> nx_secure_tls_new_key_material_data[0]); - if ((data_size > sizeof(tls_key_material -> nx_secure_tls_new_key_material_data)) || - (data_size > buffer_length)) +#ifdef NX_SECURE_ENABLE_PSK_CIPHERSUITES + if (ciphersuite -> nx_secure_tls_public_auth -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_PSK) { + if ((tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_size > + sizeof(tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id)) || + (data_size > sizeof(tls_key_material -> nx_secure_tls_new_key_material_data)) || + (((ULONG)data_size + 2u + tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_size) > buffer_length)) + { - /* Packet buffer too small. */ - return(NX_SECURE_TLS_PACKET_BUFFER_TOO_SMALL); + /* Packet buffer too small. */ + return(NX_SECURE_TLS_PACKET_BUFFER_TOO_SMALL); + } + + data_buffer[0] = (UCHAR)((tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_size & 0xFF00) >> 8); + data_buffer[1] = (UCHAR)(tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_size & 0x00FF); + NX_SECURE_MEMCPY(&data_buffer[2], tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id, + tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_size); /* Use case of memcpy is verified. */ + NX_SECURE_MEMCPY(&data_buffer[2 + tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_size], + tls_key_material -> nx_secure_tls_new_key_material_data, data_size); /* Use case of memcpy is verified. */ + data_size += 2 + tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_size; } + else +#endif /* NX_SECURE_ENABLE_PSK_CIPHERSUITES */ + { + if ((data_size > sizeof(tls_key_material -> nx_secure_tls_new_key_material_data)) || + (data_size > buffer_length)) + { - NX_SECURE_MEMCPY(data_buffer, tls_key_material -> nx_secure_tls_new_key_material_data, data_size); /* Use case of memcpy is verified. */ + /* Packet buffer too small. */ + return(NX_SECURE_TLS_PACKET_BUFFER_TOO_SMALL); + } + + NX_SECURE_MEMCPY(data_buffer, tls_key_material -> nx_secure_tls_new_key_material_data, data_size); /* Use case of memcpy is verified. */ + } } else #endif /* NX_SECURE_ENABLE_ECC_CIPHERSUITE */ @@ -145,10 +172,10 @@ NX_CRYPTO_EXTENDED_OUTPUT extended_output; /* Check for PSK ciphersuites. */ if (ciphersuite -> nx_secure_tls_public_auth -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_PSK) { - if ((tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_hint_size > - sizeof(tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_hint)) || - (tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_hint_size > - (buffer_length - 2))) + if ((tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_size > + sizeof(tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id)) || + ((buffer_length < 2u) || (tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_size > + (buffer_length - 2u)))) { /* Packet buffer too small. */ @@ -327,4 +354,3 @@ NX_CRYPTO_EXTENDED_OUTPUT extended_output; return(NX_SECURE_TLS_SUCCESS); } - |