Fixes for DH agree buffer, digest/CMAC native context lifecycle, RSA-PSS default salt, PBKDF2 JNI errors

jni/jni_dh.c

@@ -446,6 +446,7 @@ Java_com_wolfssl_wolfcrypt_Dh_wc_1DhAgree(
     byte* pub  = NULL;
     byte* secret = NULL;
     word32 privSz = 0, pubSz = 0, secretSz = 0;
+    word32 pSz = 0, qSz = 0, gSz = 0;
     jboolean privIsCopy = JNI_FALSE;
 
     key = (DhKey*) getNativeStruct(env, this);
@@ -463,6 +464,13 @@ Java_com_wolfssl_wolfcrypt_Dh_wc_1DhAgree(
      * DH_MAX_SIZE is in bits, so convert to bytes and round up if needed. */
     secretSz = (DH_MAX_SIZE + 7) / 8;
 
+    /* wc_DhAgree() does not bound its output by secretSz, and heap math
+     * allows p larger than DH_MAX_SIZE, so grow the buffer to fit p */
+    if ((key != NULL) && (wc_DhExportParamsRaw(key, NULL, &pSz, NULL, &qSz,
+        NULL, &gSz) == LENGTH_ONLY_E) && (pSz > secretSz)) {
+        secretSz = pSz;
+    }
+
     secret = XMALLOC(secretSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     if (secret == NULL) {
         throwOutOfMemoryException(

jni/jni_md5.c

@@ -293,3 +293,30 @@ Java_com_wolfssl_wolfcrypt_Md5_native_1final_1internal___3B(
 #endif
 }
 
+JNIEXPORT void JNICALL
+Java_com_wolfssl_wolfcrypt_Md5_native_1free_1internal(
+    JNIEnv* env, jobject this)
+{
+#ifndef NO_MD5
+    Md5* md5 = (Md5*) getNativeStruct(env, this);
+    if ((*env)->ExceptionOccurred(env)) {
+        /* getNativeStruct may throw exception, prevent throwing another */
+        return;
+    }
+
+    if (md5 != NULL) {
+        wc_Md5Free(md5);
+    #if (LIBWOLFSSL_VERSION_HEX >= 0x05008004) && \
+        !defined(WOLFSSL_NO_FORCE_ZERO)
+        wc_ForceZero(md5, sizeof(Md5));
+    #else
+        XMEMSET(md5, 0, sizeof(Md5));
+    #endif
+    }
+
+    LogStr("wc_Md5Free(md5=%p)\n", md5);
+#else
+    throwNotCompiledInException(env);
+#endif
+}
+

jni/jni_pwdbased.c

@@ -195,16 +195,24 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_Pwdbased_wc_1PBKDF2
 
     if ((passBuf != NULL) && (passBufLen > 0)) {
         pass = (byte*)(*env)->GetByteArrayElements(env, passBuf, &passIsCopy);
+        if ((*env)->ExceptionOccurred(env)) {
+            ret = MEMORY_E;
+        }
     }
 
-    if (saltBuf != NULL) {
+    if ((ret == 0) && (saltBuf != NULL)) {
         salt = (byte*)(*env)->GetByteArrayElements(env, saltBuf, NULL);
+        if ((*env)->ExceptionOccurred(env)) {
+            ret = MEMORY_E;
+        }
     }
 
-    PRIVATE_KEY_UNLOCK();
-    ret = wc_PBKDF2(outKey, pass, passBufLen, salt, sBufLen,
-                    iterations, kLen, hashType);
-    PRIVATE_KEY_LOCK();
+    if (ret == 0) {
+        PRIVATE_KEY_UNLOCK();
+        ret = wc_PBKDF2(outKey, pass, passBufLen, salt, sBufLen,
+                        iterations, kLen, hashType);
+        PRIVATE_KEY_LOCK();
+    }
     if (ret == 0) {
         result = (*env)->NewByteArray(env, kLen);
         if (result != NULL) {
@@ -242,6 +250,11 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_Pwdbased_wc_1PBKDF2
         (*env)->ReleaseByteArrayElements(env, saltBuf, (jbyte*)salt, JNI_ABORT);
     }
 
+    if ((*env)->ExceptionOccurred(env)) {
+        /* Leave the pending OutOfMemoryError in place */
+        return NULL;
+    }
+
     if (ret != 0) {
         throwWolfCryptExceptionFromError(env, ret);
         return NULL;

jni/jni_rsa.c

@@ -1808,24 +1808,31 @@ Java_com_wolfssl_wolfcrypt_Rsa_wc_1RsaPSS_1Verify(
     if (ret == 0) {
         XMEMSET(output, 0, outputSz);
 
-        ret = wc_RsaPSS_Verify_ex(signature, signatureSz, output, outputSz,
-                                  (enum wc_HashType)hashType, mgf,
-                                  saltLen, key);
-        if (ret > 0) {
-            /* Now verify the PSS padding with the provided data */
-            ret = wc_RsaPSS_CheckPadding_ex(data, dataSz, output, ret,
-                                            (enum wc_HashType)hashType,
-                                            saltLen, 0);
-            if (ret == 0) {
+        if (saltLen == RSA_PSS_SALT_LEN_DEFAULT) {
+            /* VerifyCheck() sizes the default salt from the modulus bits */
+            ret = wc_RsaPSS_VerifyCheck(signature, signatureSz, output,
+                outputSz, data, dataSz, (enum wc_HashType)hashType, mgf, key);
+            if (ret > 0) {
                 result = JNI_TRUE;
+                ret = 0;
             }
-            /* PSS decode of a bad signature fails with data dependent error
-             * codes, all map to false, only MEMORY_E throws */
-            else if (ret == MEMORY_E) {
-                throwWolfCryptExceptionFromError(env, ret);
+        }
+        else {
+            ret = wc_RsaPSS_Verify_ex(signature, signatureSz, output,
+                outputSz, (enum wc_HashType)hashType, mgf, saltLen, key);
+            if (ret > 0) {
+                /* Now verify the PSS padding with the provided data */
+                ret = wc_RsaPSS_CheckPadding_ex(data, dataSz, output, ret,
+                    (enum wc_HashType)hashType, saltLen, 0);
+                if (ret == 0) {
+                    result = JNI_TRUE;
+                }
             }
         }
-        else if (ret == MEMORY_E) {
+
+        /* PSS decode of a bad signature fails with data dependent error codes,
+         * all map to false, only MEMORY_E throws */
+        if (ret == MEMORY_E) {
             throwWolfCryptExceptionFromError(env, ret);
         }
     }
@@ -2041,17 +2048,29 @@ Java_com_wolfssl_wolfcrypt_Rsa_wc_1RsaPSS_1CheckPadding(
     if (ret == 0) {
         XMEMSET(pssData, 0, pssDataSz);
 
-        /* First decrypt the signature to get PSS padded data */
-        ret = wc_RsaPSS_Verify_ex(signature, signatureSz, pssData, pssDataSz,
-            (enum wc_HashType)hashType, mgf, saltLen, key);
-
-        if (ret > 0) {
-            pssDataSz = ret;
-            /* Now check the PSS padding against the digest */
-            ret = wc_RsaPSS_CheckPadding_ex(digest, digestSz, pssData,
-                pssDataSz, (enum wc_HashType)hashType, saltLen, 0);
-            if (ret == 0) {
+        if (saltLen == RSA_PSS_SALT_LEN_DEFAULT) {
+            /* VerifyCheck() sizes the default salt from the modulus bits */
+            ret = wc_RsaPSS_VerifyCheck(signature, signatureSz, pssData,
+                pssDataSz, digest, digestSz, (enum wc_HashType)hashType, mgf,
+                key);
+            if (ret > 0) {
                 result = JNI_TRUE;
+                ret = 0;
+            }
+        }
+        else {
+            /* First decrypt the signature to get PSS padded data */
+            ret = wc_RsaPSS_Verify_ex(signature, signatureSz, pssData,
+                pssDataSz, (enum wc_HashType)hashType, mgf, saltLen, key);
+
+            if (ret > 0) {
+                pssDataSz = ret;
+                /* Now check the PSS padding against the digest */
+                ret = wc_RsaPSS_CheckPadding_ex(digest, digestSz, pssData,
+                    pssDataSz, (enum wc_HashType)hashType, saltLen, 0);
+                if (ret == 0) {
+                    result = JNI_TRUE;
+                }
             }
         }